GDPR Principles: The 7 Data Protection Rules and Fines

The GDPR is built on seven principles set out in Article 5: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Every other rule in the regulation flows from these, so if you handle personal data belonging to people in the European Union, this is the foundation you are working from. The reach is broad. The regulation applies to any organization established in the EU, and it also applies to organizations based anywhere else in the world that offer goods or services to people in the EU or monitor their online behavior.¹ It does not matter whether you charge those users anything.

Six of the seven principles describe how you must treat personal data. The seventh, accountability, requires you to prove you are doing the other six.

Lawfulness, Fairness, and Transparency

The first principle under Article 5(1)(a) bundles three separate duties.²

Lawfulness means you must identify a valid legal basis before you touch any personal data. Article 6 gives you six options: the individual’s consent, performance of a contract, a legal obligation you must comply with, protection of someone’s vital interests, a public-interest task, or a legitimate interest that does not override the individual’s rights.³ You cannot start processing first and pick a justification later; the basis must be determined and documented in advance.

When consent is the basis you rely on, the bar is high. You must be able to prove consent was given, any consent request buried inside a longer document must be clearly distinguishable and written in plain language, and withdrawing consent must be as easy as giving it. Individuals must be told about that right of withdrawal before they consent.⁴ Consent is also not considered freely given if a service is made conditional on agreeing to data processing the service does not actually need.

Fairness means you cannot use data in ways that would blindside a reasonable person. If someone gives you their email to complete a purchase, using that address to build a behavioral profile they never agreed to would fail this test.

Transparency requires clear, accessible explanations of why data is collected, how it will be used, and who will receive it. Legalese buried in a 40-page privacy policy does not qualify.

Purpose Limitation

Article 5(1)(b) requires that personal data be collected for specific, clearly stated, and legitimate purposes, and that it not be repurposed for anything incompatible with the original goal.² If a customer shares their address for a delivery, you cannot later feed it into an advertising engine without a separate legal basis for doing so.

The regulation carves out exceptions for archiving in the public interest, scientific or historical research, and statistical purposes, provided appropriate safeguards are in place. Outside those exceptions, define the purpose up front and stick to it.

Data Minimization

Article 5(1)(c) requires that the data you collect be adequate, relevant, and limited to what is necessary for the stated purpose.² A shipping company needs a name and address; it does not need a date of birth, employment history, or political views. Every field on a form should be justifiable.

This is where many organizations quietly fail. The instinct to collect “everything we might need later” runs directly counter to minimization. Regulators expect you to explain the connection between each piece of data you request and the specific service you provide.

Accuracy

Article 5(1)(d) places a continuing obligation on organizations to keep personal data accurate and up to date. Every reasonable step must be taken to erase or correct inaccurate information without delay.² This is not a one-time check at the point of collection. It is an ongoing duty for as long as you hold the data.

The stakes are practical. Inaccurate data can lead to someone being denied credit, flagged during a security check, or contacted with information meant for a different person. When an individual notifies you that their information has changed, your systems need to accommodate the correction promptly.

Storage Limitation

Article 5(1)(e) prohibits keeping identifiable personal data longer than necessary for the purpose it was collected.² Once the purpose is fulfilled, the data must be deleted or anonymized so it can no longer be linked to a specific person. The same exceptions for public-interest archiving, research, and statistical use apply, subject to proper safeguards.

In practice, you need defined retention schedules. “We keep everything indefinitely” is a compliance failure waiting to happen. Each category of data should have a documented timeline for deletion, and you should be able to demonstrate that you follow through. The longer you hold identifiable data, the greater your exposure if a breach occurs.

Integrity and Confidentiality

The sixth principle, under Article 5(1)(f), requires organizations to protect personal data against unauthorized access, accidental loss, destruction, or damage through appropriate technical and organizational measures.² Integrity means the data stays accurate and unaltered unless a legitimate change is made. Confidentiality means only authorized people can access it.

Article 32 gets more specific about what “appropriate measures” looks like. It calls out encryption and pseudonymization by name, along with the ability to restore access to data quickly after a technical incident and a process for regularly testing the effectiveness of your security measures.⁵ The standard is not perfection. It is a level of security proportionate to the risk, considering the state of available technology and the cost of implementation. “We didn’t budget for it” is not a defense if the risk was foreseeable and the measures were reasonable.

Accountability

Article 5(2) ties everything together: the organization controlling the data must not only follow the six principles above but must be able to prove it.² Being compliant in practice is not enough if you cannot demonstrate it on paper.

Article 30 spells out the documentation requirement. Controllers must maintain detailed records of their processing activities, including the purposes, the categories of data and recipients, any international transfers, anticipated deletion timelines, and a description of their security measures.⁶ Processors have their own, slightly narrower, record-keeping obligations.

Two other requirements exist to help you meet accountability in higher-risk situations. When processing is likely to create a high risk to individuals’ rights, a Data Protection Impact Assessment is required before you begin. Article 35 identifies three situations that always trigger this requirement: automated profiling that produces legal effects on people, large-scale processing of sensitive data categories, and systematic monitoring of publicly accessible areas on a large scale.⁷

Certain organizations must also appoint a Data Protection Officer. Article 37 makes this mandatory for public authorities, for organizations whose core activities involve large-scale regular monitoring of individuals, and for those that process sensitive data categories or criminal-offense data on a large scale.⁸ The DPO’s independence is protected: they cannot receive instructions on how to carry out their duties, cannot be penalized for doing their job, and must report directly to the highest level of management.⁹

Article 25 adds a design duty on top of the record-keeping. Data protection must be built into your systems from the start, not bolted on later, both when you choose your tools and throughout the lifecycle of your processing.¹⁰ By default, your systems should collect only the minimum data necessary, limit how long it is stored, and restrict who can access it. If your default settings expose more data than the specific purpose requires, you have a compliance problem regardless of what your privacy policy says.

What Breaking the Principles Costs

The GDPR’s fine structure has two tiers, and the principles sit in the more serious one. Violations of obligations like record-keeping, security measures, breach notification, and privacy-by-design requirements can result in fines up to €10 million, or 2% of worldwide annual turnover from the preceding financial year, whichever is higher.¹¹

Violations of the core principles themselves under Article 5, the lawful-basis requirements under Article 6, consent conditions under Article 7, processing of sensitive data categories under Article 9, data subject rights, and rules on international data transfers face the higher tier: up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹¹ For large multinationals, that 4% figure can reach into the billions.

Supervisory authorities weigh several factors when calculating fines: the severity and duration of the violation, whether it was intentional or negligent, what steps the organization took to mitigate harm, its history of previous violations, and how cooperative it was during the investigation. The accountability documentation is exactly what regulators examine. Organizations that cannot produce records of their processing activities, impact assessments, or consent logs face an uphill battle before the substance of the violation is even evaluated.

1
General Data Protection Regulation (GDPR). Art. 3 GDPR Territorial Scope
2
General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data
3
General Data Protection Regulation (GDPR). Art. 6 GDPR Lawfulness of Processing
4
General Data Protection Regulation (GDPR). Art. 7 GDPR Conditions for Consent
5
General Data Protection Regulation (GDPR). Art. 32 GDPR Security of Processing
6
General Data Protection Regulation (GDPR). Art. 30 GDPR Records of Processing Activities
7
General Data Protection Regulation (GDPR). Art. 35 GDPR Data Protection Impact Assessment
8
General Data Protection Regulation (GDPR). Art. 37 GDPR Designation of the Data Protection Officer
9
General Data Protection Regulation (GDPR). Art. 38 GDPR Position of the Data Protection Officer
10
General Data Protection Regulation (GDPR). Art. 25 GDPR Data Protection by Design and by Default
11
General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines