Governance, Law & Compliance
Purpose limitation
Using personal data only for the specific legitimate purposes for which it was collected.
Example
Data collected for fraud prevention is not reused for advertising without a compatible purpose.
Why it matters
It limits unexpected reuse that people did not reasonably sign up for.
You'll hear it
“We collected this for support; why is it now being used for marketing?”
Can you control it?
Sometimes
Sometimes. An organization can define or influence purpose limitation through its policies, processes, contracts, and product choices. Individual users may have fewer controls.
Common questions
- Does removing a name make any new use acceptable?
- Not automatically. Other details may still identify someone, and the circumstances of the reuse matter.
- Can the purpose ever change?
- Sometimes, but the new use needs to be assessed under the applicable rules rather than assumed acceptable.
- Who should review a proposed new use?
- Someone responsible for privacy and the business purpose should check it before the reuse begins.