Reviewing legal basis, purpose limitation and data minimisation together

The purpose comes before the data collection

A concrete purpose makes it possible to check which data is really needed, who may use it and when it is no longer necessary. Vague just-in-case purposes prevent this delimitation.

Every legal basis has its own conditions

Contract, legal obligation, legitimate interest and consent are not interchangeable labels. Document the preconditions, balancing tests, options to withdraw or object, and the matching information for data subjects.

• Phrase the purpose in everyday language
• Check data fields against necessity
• Record the legal basis and the supporting evidence
• Treat changes of purpose as a new decision