Article 5 GDPR
Rules on the processing of personal data

1. Personal data must be:

(a) processed in a lawful, fair and transparent manner for the data subject (conformity, fairness and transparency);

(b) collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered, pursuant to Article 89(1), to be incompatible with the original purposes (“purpose limitation”);

(c) adequate, relevant and limited to what is necessary for the purposes for which they are processed (minimization of data);

(d) correct and, where necessary, updated; all reasonable steps must be taken to ensure that personal data which are incorrect in the light of the purposes for which they are processed are immediately deleted or corrected (Correctness);

(e) stored in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for a longer period provided that they are processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), provided that appropriate technical and organizational measures required under this Regulation are implemented to protect the rights and freedoms of data subjects (“storage limitation”);

(f) processed in a manner ensuring adequate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organisational means (integrity and confidentiality).

2. The administrator is responsible for compliance with paragraph 1 and must be able to demonstrate compliance ("accountability").