Collect data for specified, explicit purposes and don't reuse it in incompatible ways.
Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.
New, incompatible uses generally need a fresh lawful basis and transparency to the individual.
In the Regulation
Related terms
Data minimisationCollect only the personal data you actually need for your purpose — no more.Storage limitationKeep personal data in identifiable form only as long as you need it — then delete or anonymise.Lawful basisOne of the six legal grounds in Article 6 that every act of processing must rely on.
Need this applied to your business?
Our data-protection lawyers turn GDPR terms into a working plan.