GDPR Art. 5(1)(b) and 6(4): purpose limitation

Personal data are collected for specified, explicit and legitimate purposes and not further processed incompatibly; Art. 6(4) sets the compatibility test for reuse, such as training on data collected for another purpose

By Jorge García Aibar Reviewed 2026-09-24

Text alternative

Clause: GDPR, Art. 5 and 6.
Duty holder: Controller.
Applies from: 2018-05-25, In force.
Artefact: Purpose tags on datasets.
Layers: Layer 01, Layer 02.
Evidence record: Evidence record v1.
Record schema: Evidence record.
No crosswalk topic files this clause yet.

When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.

Data table: the dates

Dates of AIGE-OBL-GDPR-ART5-1B
Date	Step	Detail
2018-05-25	In force

Id: AIGE-OBL-GDPR-ART5-1B
Instrument: General Data Protection Regulation (EU) 2016/679 law
Clause: Art. 5(1)(b) and 6(4)
In scope: Controller
Authority: National data protection authority
Applies from: 2018-05-25 In force

The artefact that evidences it

Purpose tags on datasets; purpose-match policy in training and indexing pipelines; compatibility assessment record.

L1 Govern-as-Code
L2 Inventory & Transparency

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-GDPR-ART5-1B
Family	Item	Relation
Patterns	Dataset Admission Gate	Direct
Patterns	Training-Data Rights Ledger	Direct
Open controls	AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time	Direct
Open controls	AIGE-CTL-DATA-005 Purpose Match Before Reuse of Data	Direct
Open controls	AIGE-CTL-DATA-003 Training-Data Rights Ledger Row per Source	Direct

Patterns that build it

Training-Data Rights Ledger (layer 2)
Dataset Admission Gate (layer 1 and 2)

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time (Data admission and privacy profile)
AIGE-CTL-DATA-003 Training-Data Rights Ledger Row per Source (Data admission and privacy profile)
AIGE-CTL-DATA-005 Purpose Match Before Reuse of Data (Data admission and privacy profile)

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-gdpr-art5-1b.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). GDPR Art. 5(1)(b) and 6(4): purpose limitation (AIGE-OBL-GDPR-ART5-1B). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-1b. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 5(1)(b) and 6(4): purpose limitation (AIGE-OBL-GDPR-ART5-1B)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-1b},
  note         = {Version 0.5.0}
}