Art.5 Principles relating to processing of personal data
Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, erasing or rectifying inaccurate data without delay; keep it in a form permitting identification no longer than the purpose requires; and secure it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical or organisational measures. The controller is responsible for all six principles and must be able to demonstrate compliance with them.
Source: GDPR, Art.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.
Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Assurance output that demonstrates compliance rather than asserts it, such as control testing, internal audit or DPO reporting · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Minimisation analysis per collection point showing why each field is necessary for the stated purpose · Document repository
- Accuracy controls: how inaccurate data is detected, and records of rectification or erasure carried out without delay · Document repository
- The compatibility assessment for any further processing carried out for a new purpose · Document repository
governing documentDocuments that govern the control
- The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it · Document repository
- Retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs · Policy repository / GRC workspace
First move
Common gaps auditors find
- Purposes written so broadly, for example business purposes or service improvement, that no later use could ever be incompatible with them
- Retention periods published in a policy but implemented in no system, so data is in fact kept indefinitely
- Accountability treated as holding the documents rather than being able to show the principles were applied
- Minimisation never revisited after launch, so fields added for a discontinued feature keep being collected
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet