Purpose limitation is the principle that stops data drifting. Personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. must be collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with them. The words that do the work are specified (you said what it was for), explicit (you said it clearly) and incompatible (the test for any new use).
Specify the purpose properly at the start
Every later argument about reuse runs back to how the purpose was described when the data was collected. “To improve our services” is not a purpose; it is a licence to do anything. A purpose that a reasonable person could predict from the privacy notice is one that later decisions can be tested against.
Record purposes in the record of processing and in the privacy notice in the same words. When the two differ, the narrower one is what a regulator will hold you to.
The compatibility test
A new purpose is not automatically unlawful. The UK GDPR sets out what to weigh when deciding whether further processing is compatible with the original purpose:
| Factor | The question |
|---|---|
| Link | How closely is the new purpose connected to the original one? |
| Context | What is the relationship with the person, and what would they reasonably expect? |
| Nature of the data | Is it special category or criminal offence data? |
| Consequences | What would the new use mean for the person? |
| Safeguards | Is there encryption, pseudonymisationPseudonymisationReplacing identifiers so data cannot be attributed to a person without separately held information. Pseudonymised data is still personal data, unlike truly anonymous data. or another protection in place? |
If the new purpose passes, you still need a lawful basis for it, but you do not need a fresh collection. If it fails, the reuse needs its own lawful basis and its own transparency, as if the data had been collected anew.
The UK list of compatible purposes
Since 2026-02-05 the UK GDPR, as amended by the DUAA 2025, sets out a list of purposes that are treated as compatible without running the test. They include disclosures for public tasks on request, safeguarding vulnerable people, emergencies, crime, protecting public security, and complying with a legal obligation. The list lives in Article 8A and Annex 2.
Two cautions. The list removes the compatibility question, not the need for a lawful basis. And where the original basis was consent, the ordinary compatibility test is not available: Article 8A limits reuse of consented data to fresh consent or the specific cases it lists.
Research, archiving and statistics
Further processing for archiving in the public interest, scientific or historical research, or statistics is treated as compatible, provided the Article 89 safeguards are in place. The DUAA 2025 widened what counts as scientific research to include commercial research where it can reasonably be described as scientific.
Where purpose limitation fails in practice
- Data lakes. Pooling data “for analytics” without recording which purposes each source was collected for makes every downstream use unanswerable.
- Marketing from service data. Using customer support records to target marketing is the classic incompatible reuse. Direct marketing also engages PECR, which has its own consent rule.
- AI training. Reusing customer data to train a model is a new purpose. Run the test, record the outcome, and tell people.
For a complaint
“You told me my data was for X and you used it for Y” is one of the strongest complaint points there is, because it is easy to evidence: the privacy notice at the time is the proof. Quote it.