Article 5 GDPR: Cardinal Processing Principles & Accountability

The 6 Cardinal Processing Principles (Art. 5.1)

Article 5(1) of the GDPR constitutes the cornerstone of European data protection regulation. Any personal data processing must continuously comply with these substantive requirements:

• Lawfulness, fairness and transparency (Art. 5.1.a): Processed lawfully, fairly and in a transparent manner in relation to the data subject.
• Purpose limitation (Art. 5.1.b): Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data minimisation (Art. 5.1.c): Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy (Art. 5.1.d): Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate data are erased or rectified without delay.
• Storage limitation (Art. 5.1.e): Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Integrity and confidentiality (Art. 5.1.f): Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The Accountability Principle & Evidentiary Burden (Art. 5.2 & 24)

Article 5(2) enshrines the foundational principle of Accountability: the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

Accountability is an ongoing proactive obligation: documented policies, data protection impact assessments (DPIAs), records of processing activities, and technical and organisational security safeguards.

Recent enforcement demonstrates that accountability and fairness apply with heightened stringency to privacy-revealing data such as location: controllers must be able to demonstrate compliance across distinct collection settings (such as Web & App Activity, Location History, and Location Accuracy) and respect storage limitation without obscure ad inference purposes (Irish DPC final decision of 21 September 2026, Google Ireland).

IQVIA — Supervisory authority decision — Italy (23 September 2026)

In this case, the operative decision identifies Articles 5(1)(a), (e), (f) and 5(2): lawfulness, fairness and transparency, storage limitation, integrity and confidentiality, and accountability (§ 159). Safeguards for the database must demonstrably work; the decision does not find a breach of all six principles.

• Findings concern the database and operations examined; qualification must be assessed for each processing operation.

Decision no. 710, subject to judicial challenge; no filed appeal confirmed in the official sources consulted as of 11 October 2026.

Smart glasses — EDPB statement (13 October 2026)

The statement encourages limiting continuous capture, live streaming and retention. Further uses require considering original purposes and collection context; transparency alone does not make all AI training reasonably expected (§§ 19, 30, 33).

• Assess safeguards in light of the uses and individuals concerned.

Adopted statement, preliminary guidance: no new standalone obligations.

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework