GDPR Article 5(1)(b) Purpose Limitation (Compatible Research Use)

The purpose limitation principle is one of the seven core data-processing principles set out in GDPR Article 5(1). Article 5(1)(b) requires that personal data be collected for specified, explicit and legitimate purposes, and not further processed in a manner that is incompatible with those purposes. For research administrators, the operative part of the provision is the second half of the same sentence: a built-in exception stating that further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.

Why this provision matters for research data reuse

Most data used in secondary research analysis, cohort linkage studies, biobank research, and retrospective health-services research was not originally collected for that research. It was collected for patient care, for a prior unrelated study, for a public administrative function, or for a commercial service. Without a mechanism like Article 5(1)(b), each of those reuses would need to survive the full incompatibility test that Article 6(4) sets out for any new, unrelated purpose – factors like the link between the original and new purpose, the context in which the data were collected, the nature of the data, the possible consequences for the data subject, and the presence of safeguards.

Article 5(1)(b) short-circuits that analysis for the four named purposes: if the further processing genuinely is scientific research (or historical research, statistical processing, or public-interest archiving), it is deemed – by the Regulation itself – not incompatible with the original purpose. The European Data Protection Board’s guidance on processing personal data for scientific research (issued 2026) describes this as a presumption of compatibility for the research-reuse case, meaning controllers relying on Article 5(1)(b) for a genuine research purpose do not additionally need to run the Article 6(4) compatibility test for that specific step.

What Article 5(1)(b) does not do

The carve-out addresses only the compatibility question – whether further processing conflicts with the original collection purpose. It does not, by itself, supply everything else the GDPR requires:

• A lawful basis is still required. Article 5(1)(b) is not a lawful basis in its own right. The controller still needs a valid Article 6(1) ground for the further processing – commonly Article 6(1)(e) (public interest) for university and public-sector research, or Article 6(1)(f) (legitimate interests) in some private-sector research contexts, or consent where it is sought and genuinely freely given.
• Special category data still needs an Article 9(2) condition. Health, genetic, biometric, or other special category data (GDPR Article 9) being reused for research also requires a separate Article 9(2) condition – most often Article 9(2)(j), the dedicated scientific-research derogation, alongside whatever Member State law implementing Article 9(2)(j) requires.
• Article 89(1) safeguards must actually be in place. The carve-out is explicitly conditioned on compliance with Article 89(1), which requires appropriate technical and organisational measures to protect data subjects’ rights – in particular data minimisation, implemented through pseudonymisation wherever the research purpose can still be achieved that way, or anonymisation where full identification is not needed at all.
• The processing must genuinely be for one of the four named purposes. Recital 33’s broad, technology-neutral framing of scientific research (and its equivalents for archiving, historical research and statistics) does not stretch to cover further processing that is not, in substance, research – relabelling ordinary commercial reuse as research to invoke Article 5(1)(b) does not change what the processing actually is.

Relationship to Article 89(1) and Recital 33

Article 5(1)(b)’s carve-out and Article 89(1)’s safeguards operate together: Article 5(1)(b) supplies the compatibility fiction, and Article 89(1) is the condition attached to it. Recital 33 supplies interpretive context for what counts as scientific research purposes under both provisions, indicating the concept should be interpreted broadly to include technological development and demonstration, fundamental research, applied research, and privately funded research. Together, the three provisions form the legal backbone that allows secondary analysis, data linkage, cohort studies, and biobank research to proceed on data collected for another original purpose, without treating every reuse as requiring a fresh, freestanding justification against the original collection purpose – while still holding the reuse to the GDPR’s substantive protections through the lawful-basis, special-category, and safeguards requirements that remain fully in force.

Practical checklist for research administrators

• Confirm the further processing is genuinely archiving in the public interest, scientific research, historical research, or statistical in nature – not merely labelled as such.
• Identify and document the separate Article 6(1) lawful basis for the further processing (do not assume Article 5(1)(b) supplies one).
• If special category data is involved, identify the applicable Article 9(2) condition (typically Article 9(2)(j)) and any Member State law it depends on.
• Implement Article 89(1) safeguards – pseudonymise or anonymise wherever the research question can still be answered that way, and document technical/organisational measures (access controls, data minimisation, retention limits).
• Record the purpose-limitation reasoning in the study’s data protection impact assessment or equivalent documentation, since a supervisory authority or ethics review may ask for it.

Related CASRAI resources

See the broader GDPR (General Data Protection Regulation) entry for the Regulation’s overall structure, the data subject rights (GDPR) entry for how rights like erasure and objection are qualified for research processing under Articles 17(3)(d) and 21(6), and the GDPR and Data Protection Compliance in Research Involving Personal Data guide for a fuller walkthrough of lawful basis, special category conditions, and safeguards across a research data lifecycle. Companion CASRAI dictionary entries on the Article 6(1)(e) public-interest lawful basis and Recital 33’s scientific-research scope are in development and will be cross-linked here once published.