GDPR principles explained

Understanding GDPR

Shalini Kurapati, CIPP/E

Co-founder, Clearbox AI

What are they?

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimization
• Accuracy: Data quality
• Storage limitation
• Integrity and confidentiality
• Accountability

¹ Article 5 of GDPR

Lawfulness, fairness, and transparency

• Lawfulness - one of six legal bases
• Fairness - reasonable expectations
• Transparency - about the use
• Data subject rights - focus on fairness and transparency

Purpose limitation

• Specific purpose - reuse compatible with original purpose
• Example: Doctor and his travel agent wife
  • Doctor has patient data for treatment purposes, shares it with wife
  • Wife sends "get well" travel package promos - not compatible

¹ ARTICLE 29 DATA PROTECTION WORKING PARTY Opinion 03/2013 on purpose limitation

Data minimization

• Adequate, relevant, limited - collection/processing
• Not excessive,no just-in-case, right amount for your purpose

Accuracy

• Accurate
• Should not be incorrect or misleading
• Keep it up-to-date
• Example: Regular checks on accuracy of client addresses

Storage limitation

• Data retention limit
• Exceptions for research and statistics

Integrity and confidentiality

• Security principle
• Adequate measures for data safety/security

Accountability

• Controller responsible for:
  • implement principles
  • demonstrate compliance
• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimization
• Accuracy: Data quality
• Storage limitation
• Integrity and confidentiality

Let's practice!

Understanding GDPR