Article 5 GDPR: Cardinal Processing Principles & Accountability

The 6 Cardinal Processing Principles (Art. 5.1)

Article 5(1) of the GDPR constitutes the cornerstone of European data protection regulation. Any personal data processing must continuously comply with these substantive requirements:

• Lawfulness, fairness and transparency (Art. 5.1.a): Processed lawfully, fairly and in a transparent manner in relation to the data subject.
• Purpose limitation (Art. 5.1.b): Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data minimisation (Art. 5.1.c): Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy (Art. 5.1.d): Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate data are erased or rectified without delay.
• Storage limitation (Art. 5.1.e): Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Integrity and confidentiality (Art. 5.1.f): Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The Accountability Principle & Evidentiary Burden (Art. 5.2 & 24)

Article 5(2) enshrines the foundational principle of Accountability: the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

Accountability is an ongoing proactive obligation: documented policies, data protection impact assessments (DPIAs), records of processing activities, and technical and organisational security safeguards.

Verified Official Sources