What are the data protection principles?

What it is

Art 5(1) sets six principles about how data is handled and Art 5(2) adds accountability: the controller must be able to show it complies. Regulators cite the principles in most enforcement decisions, often alongside a more specific article.

What each principle requires

• Lawfulness, fairness and transparency: a lawful basis, no unjustified harm or deception, and clear information to people. Art 5(1)(a)
• Purpose limitation: collect for specified purposes and do not reuse incompatibly. The DUAA lists cases treated as compatible. Art 5(1)(b); Art 8A, Annex 2
• Data minimisation: adequate, relevant and limited to what is necessary. Art 5(1)(c)
• Accuracy: accurate and, where necessary, kept up to date. Art 5(1)(d)
• Storage limitation: kept no longer than necessary. Art 5(1)(e)
• Integrity and confidentiality: appropriate security, including against accidental loss. Art 5(1)(f)
• Accountability: be able to demonstrate compliance with all of the above. Art 5(2)

Who is responsible

Every controller, for every processing activity. Processors share the security duty directly under Art 32.

What it involves

1. Record your purposes and lawful bases.
2. Set retention periods and delete on schedule.
3. Keep data accurate and correct it on request.
4. Put security in place proportionate to the risk.
5. Keep the evidence: policies, records, DPIAs and training.

If it goes wrong

Regulatory

Breach of a principle sits in the higher tier: up to £17.5 million or 4% of annual worldwide turnover (DPA 2018 s.157). Security failures under Art 5(1)(f) are the most common ground for large penalties.

Criminal

The principles do not create offences. Separate offences cover unlawful obtaining (s.170) and destroying records to frustrate a request (s.173).

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.