Article 5Principles relating to processing of personal data

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Open the article on EUR-Lex

Other articles in this chapter

• 6
• 7
• 8
• 9
• 10
• 11

Risk, sanction and outcome

Judgments of the Court of Justice

8 decisions

• C-247/23Court of Justice of the European Union2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  Ask NovaCopilot
• C-394/23Court of Justice of the European Union2025-01-09

  Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object.

  Ask NovaCopilot
• C-65/23Court of Justice of the European Union2024-12-19

  MK v K GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

  Ask NovaCopilot
• C-446/21Court of Justice of the European Union2024-10-04

  Maximilian Schrems v Meta Platforms Ireland Limited

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Online social networks – General terms of use relating to contracts concluded between a digital platform and a user – Personalised advertising – Article 5(1)(b) – Principle of purpose limitation – Article 5(1)(c) – Principle of data minimisation – Article 9(1) and (2) – Processing of special categories of personal data – Data concerning sexual orientation – Data which are made public by the data subject.

  Ask NovaCopilot
• C-621/22Court of Justice of the European Union2024-10-04

  Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Lawfulness of processing – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party – Concept of ‘legitimate interests’ – Commercial interest – Sports federation – Disclosure, for consideration, of the personal data of the members of a sports federation to sponsors without the consent of those members.

  Ask NovaCopilot
• C-687/21Court of Justice of the European Union2024-01-25

  BL v MediaMarktSaturn Hagen-Iserlohn GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Interpretation of Articles 5, 24, 32 and 82 – Assessment of the validity of Article 82 – Inadmissibility of the request for an assessment of validity – Right to compensation for damage caused by data processing which infringes that regulation – Transmission of data to an unauthorised third party on account of an error made by the employees of the controller – Assessment of the appropriateness of the protection measures implemented by the controller – Compensatory function fulfilled by the right to compensation – Effect of the severity of the infringement – Whether necessary to establish the existence of damage caused by that infringement – Concept of ‘non-material damage’.

  Ask NovaCopilot
• C-231/22Court of Justice of the European Union2024-01-11

  État belge v Autorité de protection des données

  Reference for a preliminary ruling – Approximation of laws – Protection of natural persons with regard to the processing of personal data and free movement of such data (General Data Protection Regulation) – Regulation (EU) 2016/679 – Point 7 of Article 4 – Concept of ‘controller’ – Official journal of a Member State – Obligation to publish as they stand company documents prepared by companies or their legal representatives – Article 5(2) – Successive processing of the personal data contained in such documents by several separate persons or entities – Determination of responsibilities.

  Ask NovaCopilot
• C-340/21Court of Justice of the European Union2023-12-14

  VB v Natsionalna agentsia za prihodite

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5 – Principles relating to that processing – Article 24 – Accountability of the controller – Article 32 – Measures implemented to ensure security of processing – Assessment of the appropriateness of such measures – Scope of judicial review – Taking of evidence – Article 82 – Right to compensation and liability – Possible exemption from liability of the controller in the event of infringement by third parties – Claim for compensation for non-material damage based on fear of potential misuse of personal data.

  Ask NovaCopilot

Judgments applying this article

54 judgments in the register cite the article in their text. SE 4 · EU 42 · DE 8

• eu:c-77-21
• eu:c-484-24-62024cj0484
• eu:c-175-20-62020cj0175
• eu:c-231-22-62022cj0231
• eu:c-340-21
• eu:c-446-21
• eu:c-60-22
• eu:c-439-19
• eu:c-474-24
• eu:c-129-21-62021cj0129
• eu:c-200-23-62023cj0200
• eu:c-312-24

Source: NovaCopilot

Recitals that carry the interpretation

The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.

• Skäl 39 · Article 5

  The Article 5 principles made concrete: lawfulness, transparency and that the data subject knows of the processing.

Guidance and secondary law

Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.

• Opinion · EDPB2024-12-18
  Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

  When AI models process personal data: anonymity, legitimate interest and the consequences of unlawfully trained models.

  Article 4, 5, 6

• Guideline · EDPB2023-02-14
  Guidelines 03/2022 on deceptive design patterns in social media interfaces

  Deceptive design patterns in interfaces, read against Articles 5, 12, 13 and 25.

  Article 5, 12, 13, 25