GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
If a new use passes the compatibility test, the holder needs no fresh lawful basis. If it fails, the holder needs a new basis such as consent, which in practice is hard to get for old records.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required.”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
- GDPR Article 14(5)(b): disproportionate effort (Regulation (EU) 2016/679, Art 14(5)(b))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide