What are the data protection principles?
Definition
The data protection principles are the seven rules in Article 5 of the UK GDPR that organisations must follow when they handle personal data, from lawfulness and fairness to security and accountability.
- Category
- Privacy
- Also called
- UK GDPR principles, GDPR principles, principles of data protection
- Last updated
Any organisation that handles your personal data in the UK has to follow seven principles. They are set out in Article 5 of the UK GDPR, and the ICO says they "lie at the heart" of the regime and inform everything that follows.
The seven principles
- Lawfulness, fairness and transparency. Data must be processed lawfully, fairly and in a way you can understand.
- Purpose limitation. It is collected for specified, explicit and legitimate purposes and not used in ways that clash with them.
- Data minimisation. Only what is adequate, relevant and necessary for the purpose.
- Accuracy. Kept accurate and up to date, with inaccurate data erased or corrected without delay.
- Storage limitation. Kept in an identifiable form no longer than necessary.
- Integrity and confidentiality (security). Protected against unauthorised or unlawful processing, accidental loss, destruction or damage.
- Accountability. The controller is responsible for complying and must be able to show it.
What this means for you
The principles are not a list of hard rules for every case. The ICO describes them as embodying the spirit of the regime, with very limited exceptions. A company that collects your phone number for one purpose and then sells it on has a purpose limitation problem. One that keeps your records for years after you leave has a storage limitation problem.
Breaking the principles can be costly. The ICO notes that infringements of the basic principles fall in the highest tier of fines: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
The ICO has also said its guidance is under review because of changes made by the Data (Use and Access) Act, including an update to purpose limitation in March 2026.
How to protect yourself
- 1
Ask what a company holds and why
You can write to an organisation and ask for the personal data it holds about you. It should be able to explain what it uses the data for.
- 2
Ask for inaccurate data to be corrected
The accuracy principle means wrong data should be corrected or erased without delay. Send your request in writing and keep a copy.
- 3
Ask for data to be deleted when it is no longer needed
Under storage limitation, companies shouldn't keep identifiable data longer than necessary. If you've left a service, ask them to delete your account data.
- 4
Complain to the regulator if you get nowhere
If an organisation ignores you, you can report it to the ICO, the UK regulator that enforces these rules.
- 5
Find who is listing you
Companies that sell or publish your details, such as people-search sites, are still bound by the law in the UK. Serus finds where your address and phone number are listed and sends the removal requests for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How many data protection principles are there?
Seven under the UK GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Who has to follow the principles?
Organisations that decide how and why personal data is processed, which the law calls controllers. The accountability principle makes the controller responsible for complying and for showing how.
What is the difference between data minimisation and storage limitation?
Data minimisation is about how much data is collected. Storage limitation is about how long it is kept in a form that identifies you.
Sources
Something wrong or out of date? Tell us and we'll re-check it.