Purpose limitation
The GDPR Article 5(1)(b) principle that personal data collected for one specified, explicit, and legitimate purpose may not later be processed in a way incompatible with that original purpose. Closely related to storage limitation: a dataset repurposed beyond its original justification often loses its retention justification at the same time, since the purpose that justified keeping it has changed without a fresh lawful basis being established.
Defined in 5 GAGE programs, which carry 12 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The GDPR Article 5(1)(b) principle that personal data collected for one specified, explicit, and legitimate purpose may not later be processed in a way incompatible with that original purpose. Closely related to storage limitation: a dataset repurposed beyond its original justification often loses its retention justification at the same time, since the purpose that justified keeping it has changed without a fresh lawful basis being established.
The PIPL principle that personal information collected for one stated purpose should not, without a new legal basis such as fresh consent, be used for a materially different purpose. Repurposing customer-service data to train a new AI model is a common example of a purpose change that this principle governs.
The privacy principle that personal data collected for one specified purpose may not be freely reused for an unrelated, incompatible purpose. Written into the GDPR at Article 5(1)(b), the CCPA/CPRA at California Civil Code section 1798.100(c), South Korea's PIPA, and most modern privacy regimes.
The privacy principle, codified in GDPR and reflected in other frameworks, that data collected for one stated purpose should not be repurposed for a different, undisclosed purpose without a new, explicit basis.
The requirement that purposes be specified, explicit and legitimate, and that further processing not be incompatible with them. Article 5(1)(b).
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- The interview sweep: what the humans know about the data that the systems do not · The Estate Survey, Certified AI Data Governance Professional (CADGP)
- Purpose archaeology: what your data was collected FOR versus what it feeds now · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- The "we have always had this data" trap: age does not launder a dataset · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Retention versus the model that memorized: deleting data a model already learned from · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Training data governance: what may teach a model, decided before the model exists · Feeding the Machines, Certified AI Data Governance Professional (CADGP)
- Row, column, and purpose: access that follows the data's sensitivity, not the org chart · Access and the Keys, Certified AI Data Governance Professional (CADGP)
- The deletion decision: the terabytes your organization should destroy this quarter, defended · The Money of Data, Certified AI Data Governance Professional (CADGP)
- The map of hidden data workers: everyone in your organization who touches data without the title · The Humans of Data, Certified AI Data Governance Professional (CADGP)
- Consent archaeology: what this data was collected for versus what you want to do · Data Reality, Certified AI Governance Professional (CAIGP)
- The provenance file: your data map an auditor could follow · Data Reality, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where Purpose limitation starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Traces where data came from, what transformed it, who owns each hop and where it flows downstream, so a number can be defended.
2 lessons on this page teach it as a primary outcome.
Classifies information, applies least privilege, sets retention and acceptable-use rules, and controls what may enter a prompt, a log or an embedding.
2 lessons on this page teach it as a primary outcome.
Profiles data, sets rules and thresholds, monitors, assigns issues to owners, and knows when data is not fit to train or run a model.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Data Governance Leadneeds it at depth · 2 open postings this week
- Chief Data Officer, data leadership editionneeds it at depth
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Privacy Analystneeds working knowledge
- AI Auditorneeds working knowledge · 9 open postings this week
- Third-Party AI Risk Analystneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act Article 10; NIST AI RMF MAP 4; ISO/IEC 27001; GDPR Article 5.
One interview question about it
Trace the lineage of a training dataset back to its source. What do you record, and what breaks when you cannot?
Asked of candidates for data lineage and provenance. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as work you can show: Data maps and records of processing are lineage by another name.
- Data analysis, stewardship and business intelligence carries it as work you can show: Source-to-report lineage is what you trace.
- A data science, statistics or analytics degree carries it as a claim to back up: Lineage and provenance are known ideas, rarely yet documented for an auditor.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.