AI Governance Engineer
GitHub

GDPR Art. 5(1)(b) and 6(4): purpose limitation

Personal data are collected for specified, explicit and legitimate purposes and not further processed incompatibly; Art. 6(4) sets the compatibility test for reuse, such as training on data collected for another purpose

By Reviewed

From clause to evidenceThe chain from GDPR Art. 5(1)(b) and 6(4) to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseGDPRArt. 5 and 6Duty holderControllerApplies from2018-05-25In forceArtefactPurpose tags ondatasetsLayersLayer 01Layer 02Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 5(1)(b) and 6(4) to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseGDPR · Art. 5 and 6Duty holderControllerApplies from2018-05-25 · In forceArtefactPurpose tags on datasetsLayersLayer 01Layer 02Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART5-1B. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 5 and 6.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: Purpose tags on datasets.
  • Layers: Layer 01, Layer 02.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
Id
AIGE-OBL-GDPR-ART5-1B
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 5(1)(b) and 6(4)
In scope
Controller
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

Purpose tags on datasets; purpose-match policy in training and indexing pipelines; compatibility assessment record.

Patterns that build it

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 5(1)(b) and 6(4): purpose limitation (AIGE-OBL-GDPR-ART5-1B). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-1b. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 5(1)(b) and 6(4): purpose limitation (AIGE-OBL-GDPR-ART5-1B)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-1b},
  note         = {Version 0.5.0}
}