Purpose limitation
Collecting personal data for specified, explicit and legitimate purposes and not reusing it in incompatible ways.
Purpose limitation is the GDPR principle that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. It stops data gathered for one task, such as initiating a payment, from being quietly reused for another, such as marketing or model training. For agents, the purpose recorded in a consent or mandate becomes the boundary that later uses are tested against.
Agent Minute explains this term on 18 November 2026.
Related terms
Data minimisationUsing personal data that is adequate, relevant and limited to what is necessary for the purpose.Lawful basisOne of the six grounds in the GDPR that make processing personal data lawful, of which consent is only one.ConsentA freely given, specific, informed and unambiguous indication of a person's agreement to the processing of their data.Personal dataAny information relating to an identified or identifiable living person.