Oposiciones →
Module 2 of 7 · 20 min

The principles: purpose, only what is needed, only as long as needed

Free data protection course: read the module, review with the questions and move on to the next one. At the end, a test and a PDF certificate.

Module 2 of 7 · Course contents

Article 5 of the GDPR sets the rules every processing operation must follow. Data must be:

  • Lawful, fair and transparent: the person must know what is done with it.
  • Purpose limitation: collected for specific purposes and not later used for something incompatible.
  • Data minimisation: only what is needed for that purpose.
  • Accurate and, where necessary, kept up to date.
  • Storage limitation: kept no longer than necessary.
  • Integrity and confidentiality: protected against unauthorised access, loss or destruction.

Accountability

The controller must not only comply but also be able to demonstrate compliance (article 5.2).

In practiceThe phone number a customer left so you could tell them their order had arrived cannot be added to a WhatsApp offers list: that is a different purpose.

Source: Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), article 5

Quick review

Check that you've understood. These are questions from the final test: tap an answer to see whether it's right and why.

What does the data minimisation principle require?

Using delivery customers' phone numbers to send them advertising breaches the principle of…

How long can data be kept?

Module practice test

5 new questions, different from the final test. Tap an answer to see whether it is right, why, and which rule it comes from.

1. What does it mean for processing to be «transparent»?

2. A customer's address has changed. Which principle requires correcting it?

3. Asking for date of birth to sign up to a newsletter, without needing it, breaches the principle of…

4. Protecting data against loss or unauthorised access meets the principle of…

5. Who must be able to demonstrate that the principles are met?

Course contents