The seven Article 5 principles and their DPDP counterparts

Article 5(1) sets six principles of processing; Article 5(2) adds accountability as the seventh [L3-C1]. Each principle is enforceable in its own right and DPAs frequently cite the specific principle alongside the specific-provision breach. Amazon's EUR 746 million CNPD Luxembourg fine of 2021 rested on Article 6 legal basis, but the principles of lawfulness and fairness under Art 5(1)(a) framed the reasoning. That fine has since had a chequered path: the Luxembourg administrative court annulled the CNPD decision in March 2026 and sent it back to the regulator for reconsideration, with the amount, reasoning, or the entire outcome now uncertain. Do not read the annulment as a defence for equivalent practices in your own organisation; the underlying Art 5(1)(a) fairness question survives even where the specific quantum has been unwound on procedural grounds. Similarly, H&M's EUR 35.3 million HmbBfDI Hamburg fine of 2020 was for employee-monitoring processing beyond legitimate HR purpose, cited to Art 5 principles read with Art 6.

The seven principles and DPDP counterparts

Why enforcement often cites the principle alongside the article

A DPA finding of "no valid legal basis" under Art 6 becomes stronger when framed as "no valid legal basis, therefore processing was not lawful within the meaning of Art 5(1)(a)". A finding of "excessive retention" is stronger as "excessive retention, contrary to Art 5(1)(e)". The principle framing is the DPA's way of saying the failure is not just technical, it is at the level of the framework's design intent. Practitioner implication: when your team reviews internal controls, review them against principles as well as articles. A control that satisfies Art 32 security but that leaves a footprint through Art 5(1)(f) is not a defence.

The CJEU has repeatedly used Article 5 as its interpretive lens. In Meta Platforms v Bundeskartellamt (C-252/21, 4 July 2023), the Court read the principle of purpose limitation into the analysis of consent in a competition setting and held that a dominant undertaking must not treat consent as a package-deal offering. In Bindl v Commission (T-354/22, January 2025), the General Court read Article 5(1)(f) integrity and confidentiality alongside Article 32 to find the Commission itself in breach for an unauthorised third-country transfer via a "Sign in with Facebook" button on its own website — a rare but instructive case of a Union institution being fined EUR 400 in symbolic damages. If the Commission can be found in breach of Article 5 principles, no Indian data fiduciary can plausibly argue that principle compliance is a nice-to-have.

Accountability is not a slogan

The seventh principle (Art 5(2)) is the reason a DPO office exists, the reason you keep an Article 30 ROPA, the reason you run DPIAs. Accountability is the operational discipline of being able to show a supervisor how you comply. Nothing else in the Regulation reads as clearly as Art 5(2), and every subsequent article (from records under Art 30 to DPO tasks under Art 39) is a mechanism for delivering it.

DPDP\'s SDF regime (Section 10 read with Rule 12 [L3-C3]) mirrors this by requiring the SDF to appoint a DPO, run periodic DPIAs, run algorithmic-fairness audits, and undergo independent audit. For a dual-regime entity, treat the union of the two accountability regimes as your operating standard.

Practical takeaway

Post the seven principles above your privacy team's workspace. Every design review, every vendor onboarding, every policy refresh should be able to be traced to a principle. If you cannot say which principles a decision advances or protects, you are missing the accountability discipline of Art 5(2).

Worked scenario: adtech pixel review under the seven principles

Your marketing team wants to embed a new adtech pixel on the EU customer login page to build a retargeting audience. Walk it through the seven principles before you approve:

1. Lawfulness (Art 5(1)(a)): Which Art 6 basis? For adtech tracking on data subjects in the Union, the CNIL, DPC, and Belgian APD have all held that legitimate interests is not available and consent under Art 6(1)(a) is required. Consent must meet Art 7 standards: freely given, specific, informed, unambiguous, and separately for each purpose. No consent, no pixel.
2. Purpose limitation (Art 5(1)(b)): The pixel's stated purpose is retargeting. If your team later uses the same signal for creditworthiness or fraud scoring, that is incompatible further processing unless separately consented or brought under a compatibility analysis (Recital 50 factors).
3. Minimisation (Art 5(1)(c)): Is the pixel collecting anything beyond the retargeting purpose? Full-page URL trees, referrer history, viewport dimensions, mouse-movement heatmaps — are all of these necessary? Trim aggressively; the DPA reads Art 5(1)(c) alongside Art 25 Data Protection by Design.
4. Accuracy (Art 5(1)(d)): Less relevant for behavioural signals; still, if the pixel feeds a segment used for eligibility decisions (loan pre-approval, insurance quote), accuracy matters and periodic sample audits become a control.
5. Storage limitation (Art 5(1)(e)): How long do you hold the raw event data, and how long the aggregated segment? CNIL published cookie retention guidance capping most third-party ad cookies at 13 months. Match.
6. Integrity and confidentiality (Art 5(1)(f)): Pixel provider's Art 32 posture; TLS in transit; access controls on the segment database; Article 28 processor contract in place.
7. Accountability (Art 5(2)): The decision is documented in your DPIA (Art 35), the pixel appears in your Art 30 ROPA, the consent capture is auditable, the retention rule is enforced by a scheduled job, and the DPO has signed off.

Now compress that same review to a 15-minute check for any new tool. Not seven memos; one worksheet, seven rows. The principle discipline scales.