Purpose limitation: Under GDPR, which principle most directly governs whether this new use is permitted?
Reusing data collected for one purpose to train an AI model raises purpose limitation and its compatibility test.
The question
A retailer collected customer contact details to fulfill orders. It now wants to reuse that same personal data to train a marketing-propensity AI model. Under GDPR, which principle most directly governs whether this new use is permitted?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Storage limitation, requiring that personal data be kept no longer than strictly necessary for its stated purposesPlausible but wrong: storage limitation concerns retention duration, not repurposing already-held data.
- Data minimization, requiring that only personal data adequate and necessary for the purpose be processedRelated, but minimization limits the volume of data, not whether a new purpose is compatible.
- Accuracy, requiring that personal data be kept correct and, where necessary, updated over its lifecycleA real principle, but accuracy addresses data correctness, not the legitimacy of a secondary purpose.
- Purpose limitation, requiring the new AI use to be compatible with the original order-fulfillment purpose ✓Correct: reusing data for a new purpose triggers the purpose-limitation compatibility question.
The trap
Reaching for data minimization whenever AI training uses personal data, instead of the purpose-compatibility issue. How to remember it
Reusing data collected for one purpose to train an AI model raises purpose limitation and its compatibility test.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- ISO/IEC 42001: Which ISO/IEC standard is designed for this purpose? →
- Data minimization: Under GDPR, which requirement most directly challenges this plan? →
- Carrying out a data protection impact assessment before: Before deployment, which GDPR controller obligation →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.