What are the GDPR principles? Art. 5 simply explained

What does Article 5 of the GDPR regulate?

Article 5 of the General Data Protection Regulation (GDPR) defines the fundamental principles – the so-called GDPR principles – for handling personal data. It is the heart of the Regulation: every processing operation – from storing a customer address to sending a newsletter – must be measured against these principles. In paragraph 1, Article 5 names six substantive principles and, in paragraph 2, the overarching accountability obligation. Anyone who understands these principles has laid the foundation for almost every further data protection question, because all of the GDPR's more specific provisions ultimately give concrete form to these principles.

The six principles at a glance

1. Lawfulness, fairness, transparency: data may only be processed on a valid legal basis, fairly, and in a way that is comprehensible to the data subject.
2. Purpose limitation: data is only collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.
3. Data minimization: processing is limited to what is adequate, relevant, and necessary for the purpose – no more.
4. Accuracy: data must be factually accurate and, where necessary, kept up to date; inaccurate data must be rectified or erased.
5. Storage limitation: personal data is only kept in identifiable form for as long as is necessary for the purpose – after that, data is deleted or anonymized.
6. Integrity and confidentiality: data must be protected against unauthorized access, loss, or damage by appropriate technical and organisational measures.

These six principles are of equal rank and apply simultaneously to every processing operation – they cannot be played off against each other.

The accountability obligation (paragraph 2)

Paragraph 2 adds a meta level to the six principles: accountability. Controllers must not only ensure compliance with the principles but also be able to demonstrate it – for example through documentation, a record of processing activities, or internal policies. Accountability explains why data protection has to be documented and organized in practice.

What the principles mean in practice

The principles are not abstract accessories but the yardstick for every data protection assessment. They work together: anyone who only collects the data they really need (data minimization), uses it for clearly defined purposes, and protects it appropriately meets a large part of the requirements. The principle of "integrity and confidentiality" also includes organizational measures – such as raising employee awareness, a core topic of security awareness. Our Data Protection & Information Security category brings together further fundamentals on this topic. This article explains the principles in general terms and does not replace legal advice in individual cases.

What is the difference between purpose limitation and data minimization?

Purpose limitation determines what data may be used for – namely only for the originally specified, explicit purpose. Data minimization, by contrast, concerns the quantity: only as much data may be collected as is adequate, relevant, and truly necessary for this purpose. The two principles interlock but address different questions – the what for and the how much.

What does accountability mean in concrete terms?

Controllers must be able to prove at any time that they actually comply with the GDPR principles – so it is not enough merely to follow them. In practice, this proof is provided through documentation such as the record of processing activities, internal policies, and recorded evidence of the protective measures taken. This is exactly why data protection has to be documented and organized in a structured way.

Do the principles apply to all companies?

Yes. As soon as personal data is processed, the principles of Art. 5 apply – regardless of company size or industry. They are therefore binding on every company and every organization. The only difference is the practical scope: how much effort implementation requires depends on the nature, scope, and risk of the respective processing.

• Regulation (EU) 2016/679 (GDPR), Article 5 „Grundsätze für die Verarbeitung personenbezogener Daten": eur-lex.europa.eu (applicable since 25 May 2018; accessed 29 May 2026).
• Federal Data Protection Act (BDSG) – supplementary national law: gesetze-im-internet.de.