HumenhukCIPP/US Study Guide
Chapter 14: The GDPR and International Privacy Issues

The Seven General Principles

Reviewed by Victor Humenhuk. Published . Reviewed .

All processing must abide by the GDPR's seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability, under which the controller must demonstrate compliance with the other six.

How this supports CIPP/US study

Use this lesson to identify the disclosure, workplace or cross-border rule that changes the result in a fact pattern. Continue with the CIPP/US study plan.

  1. Lawfulness, fairness and transparency
  2. Purpose limitation
  3. Data minimization
  4. Accuracy
  5. Storage limitation
  6. Integrity and confidentiality
  7. Accountability

Lawfulness, fairness, transparency: there must be a legal basis, and notices must be concise, accessible, and in clear plain language (especially for children). Purpose limitation: collect for specified, explicit, legitimate purposes; do not further process incompatibly - though archiving in the public interest, scientific or historical research, or statistics is not incompatible.

Data minimization: adequate, relevant, limited to what is necessary; delete or anonymize what is no longer needed. Accuracy: keep data accurate and up to date; erase or rectify without delay. Storage limitation: keep no longer than necessary. Integrity and confidentiality: security appropriate to the risk.

Accountability is the meta-principle

Under Accountability, the controller is responsible for and must be able to demonstrate compliance with the other six principles - through documenting breaches (even unreported ones), keeping records of processing, and conducting DPIAs.

Key terms - quick answers

What is “Purpose limitation”?
Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in incompatible ways.
What is “Data minimization”?
Processing must be adequate, relevant, and limited to what is necessary for the purpose.
What is “Storage limitation”?
Personal data must be kept no longer than necessary for the purposes of processing.
What is “Accountability”?
The principle requiring the controller to be responsible for, and able to demonstrate, compliance with the other six principles.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.