KB 2023 004108 - [2025] EWHC 1824 (KB)

The second processing principle under article 5(1) UK GDPR requires that personal data shall be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes” (article 5(1)(b)). As part of the transparency obligation under article 14(1)(c) a controller must inform a data subject of the purposes of the intended processing.

In assessing whether a subsequent purpose is “incompatible” with the original purposes, assistance is provided by recital (50), which identifies the following factors as potentially relevant: (i) the links between the purposes; (ii) the context in which the data was collected; (iii) the reasonable expectations of the data subjects about the use of their data; (iv) the nature of the data; and (v) the consequences of the intended further processing and the existence of safeguards for the data subjects.

As already observed, however, by virtue of paragraph (5) of Schedule 2 to the DPA 2018, the purpose limitation will not apply to personal data where disclosure of the data “is otherwise necessary for the purposes of establishing, exercising or defending legal rights” and the application of the limitation would prevent the controller making the disclosure.