Purpose limitation: Which GDPR principle is most directly | AIGP
Pass or your money back — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

Purpose limitation: Which GDPR principle is most directly violated?

AIGP Understanding How Laws, Standards and Frameworks Apply to AI Hard

Reusing order-fulfillment data for incompatible behavioral profiling without a valid basis is a purpose-limitation violation.

The question

A retailer trained a recommendation model on customer data it originally collected only to fulfill orders, then reused that data for behavioral profiling without giving customers any new notice or basis. Which GDPR principle is most directly violated?

Preparing for AIGP? Take the free 5-min readiness quiz →

  1. Purpose limitation - fulfillment data is reused for incompatible profiling without a valid basis. ✓
    Correct: data collected for a specified purpose (order fulfillment) is reused for a new, incompatible purpose (profiling) without a compatible basis, which is the core purpose-limitation breach.
  2. Data minimization - the retailer processed more personal data than the original stated purpose required.
    Plausible but wrong: the issue is not the volume of data collected but that lawfully held data was repurposed; minimization concerns adequacy and necessity of the data set.
  3. Transparency - customers received no clear, accessible information about the new profiling use.
    Plausible but wrong: a notice failure is present, but the defining violation is the incompatible repurposing itself, which purpose limitation captures more directly.
  4. Storage limitation - the personal data was retained far longer than was strictly necessary.
    Plausible but wrong: nothing in the scenario turns on retention duration; the harm arises from using the data for a new purpose, not from keeping it too long.
The trap
Selecting transparency for the missing notice rather than purpose limitation for the incompatible reuse that drives the breach.

How to remember it

Reusing order-fulfillment data for incompatible behavioral profiling without a valid basis is a purpose-limitation violation.

How many of these would you get right?

One of 499 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.

Test your AIGP readiness — free

More Understanding How Laws, Standards and Frameworks Apply to AI questions

Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI · Every answer, right and wrong, comes with its own explanation.