EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 5

Analysis in our dossiers
Scientific research and commercial R&D

Text

Article 5 GDPR as printed in the Council text of 22 October 2026

Principles relating to processing of personal data

Source Council, 22 October 2026. Article 5: ST 14756/26, page 132 · exact text page

Scope This text prints Article 5(1)(b) only.

(1)(b)

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation (‘purpose limitation’);

Article 5 in the whole GDPR

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council21 May 2026Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
1Point (b) Amends Changed Amends , changed since the proposal Changed Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged 11
Provisions only Parliament would add or change5 units Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 8

Each text against the law in force: ~Amends amends the law in force— neither the law in force nor the text has it changed from the text before

Each text against the text before it: ~Changed wording changed=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Amends point (b) of paragraph 1. Article 5 in this text
  2. 21 May 2026 Council textST 9547/26 Changed Changes point (b) of paragraph 1.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 5 in this text
  3. 10 Jun 2026 Council textST 10426/26 Unchanged Same as the text before. Article 5 in this text
  4. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 5 in this text
  5. 22 Jun 2026 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)CJ72-PR-786818 1 amendment to this article. Amendments in this document
  6. 29 Jun 2026 JURI amendments 69–296 to the draft opinionJURI-AM-790236 1 amendment to this article. Amendments in this document
  7. 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 2 amendments to this article. Amendments in this document
  8. 27 Jul 2026 ITRE–LIBE amendments 777–1052 to the draft reportCJ72-AM-791072 15 amendments to this article. Amendments in this document
  9. 3 Sep 2026 Council textST 12535/26 Unchanged Same as the text before. Article 5 in this text
  10. 2 Oct 2026 Council textST 13886/26 Unchanged Same as the text before.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker. Article 5 in this text
  11. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 5 in this text

Paragraph 1: Point (b)

Changed by the Commission · changed by the Council on 21 May

Parliament amendments 11

1 would delete the wording and 10 propose alternative wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfEESNNIRapporteur
− Deletion1·········
~ Alternative1111112111

By political group

  • − Deletion The Left 1
  • ~ Alternative The Left 1 S&D 1 Greens/EFA 1 Renew 1 EPP 1 ECR 1 PfE 2 ESN 1 NI 1 Rapporteur 1

Show

  1. 45 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “subject to the application of appropriate safeguards”

    (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  2. 359 Alternative Virginie JoronPfE · IMCO ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further…

    ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 5(1)(b)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5
  3. 990 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    2. Article 5 (1)(b) is replaced by the following: ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2026/679 / Article 5 – paragraph 1 – point b
  4. 991 Alternative Bart Groothuis +8Renew · ITRE–LIBE “or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models…”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the development, training, testing, validation or use of new technical solutions based on aggregated data, including AI systems and AI models, subject to the safeguards in Article 88c and without prejudice to Article 9 shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

    Justification

    Data collected for one purpose can be reused for research, statistics, archiving, or for training, testing, or using AI systems on data from which individuals are not identifiable, and this reuse is deemed compatible with the original purpose (so no separate legal basis is needed under Art. 6(4)), provided the Article 88c safeguards apply and it doesn’t override Article 9 (special category data protections).

    Tabled by
    Bart Groothuis, Ivars Ijabs, Morten Løkkegaard, Nikola Minchev, Svenja Hahn, Andreas Glück, Katri Kulmuni, João Cotrim De Figueiredo, Ana Vasconcelos
    Group
    Renew
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  5. 992 Alternative Mary KhanESN · ITRE–LIBE “testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as…”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1),only be considered to be compatible with the initial purposes, independent ofwhen the conditionsrequirements of Article 6(4) and guarantees of thisArticle Regulation89(1) have been met. General product development as well as the training, testing or validation of general AI systems or AI models shall not be considered compatible purposes solely on the basis of their designation as research (‘purpose limitation’);’

    Justification

    Purpose limitation is a core principle of informational self-determination. A research label shall not replace testing.

    Tabled by
    Mary Khan
    Group
    ESN
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  6. 993 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “subject to the application of appropriate safeguards”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the application of appropriate safeguards in accordance with Article 89(1) and the principle of lawfulness, be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  7. 994 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further…”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  8. 995 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further…”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  9. 996 Alternative Sibylle Berg +1NI · ITRE–LIBE “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further…”

    collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be compatibleincompatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

    Justification

    Reinstatement of the currently valid text of the Regulation.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  10. 997 Alternative João OliveiraThe Left · ITRE–LIBE “subject to the implementation of appropriate safeguards”

    ‘collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, subject to the implementation of appropriate safeguards in accordance with Article 89(1), be considered to be compatible with the initial purposes, independent of the conditions of Article 6(4) of this Regulation, (‘purpose limitation’);’

    Tabled by
    João Oliveira
    Group
    The Left
    Targets
    GDPR Article 5(1)(b)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 / Regulation (EU) 2016/679 / Article 5 – paragraph 1 – point b
  11. 1014 Alternative Axel VossEPP · ITRE–LIBE “Personal data shall be:"”

    2d. Article 5, paragraph 1, point c is deleted:

    1. Personal data shall be:"

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 5 – paragraph 1– point c
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 d (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 1– point c

Provisions only Parliament amendments would add or change

8 amendments on 5 units the Commission proposal leaves unchanged

Paragraph 2Not amended by the Commission2 proposals

  1. 1006 Addition Kristian VigeninS&D · ITRE–LIBE “The controller shall be responsible for, and demonstrate compliance with, paragraph 1 (‘accountability’).”

    2a. Article 5, paragraph 2 is amended as follows

    2.The controller shall be responsible for, and demonstrate compliance with, paragraph 1 (‘accountability’).

    Tabled by
    Kristian Vigenin
    Group
    S&D
    Targets
    GDPR Article 5 – paragraph 2
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 2
  2. 1009 Alternative Axel VossEPP · ITRE–LIBE “When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection…”

    2b. In Article 5, paragraph 2 is amended:

    2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). When assessing compliance with the accountability obligation, appropriate governance structures, in particular, the appointment of a data protection officer in accordance with Article 37, shall be taken into account."

    Justification

    DPO Package #1: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 5 – paragraph 2
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 b (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 2

Paragraph 2a (new)New2 proposals

  1. 1000 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to…”

    2a. In Article 5, the following paragraph 2a is inserted:

    Where a controller collects personal data from a third party, or purchases, aggregates, enriches, sells or otherwise makes personal data available to third parties for commercial purposes, it shall, as part of the measures referred to in Article 24, verify and document the lawful origin of the data, the legal basis for their initial collection and for any subsequent processing, the purposes for which they were collected, the categories of data and of data subjects concerned, the information provided pursuant to Articles 13 and 14 and, where applicable, the validity of the consent obtained.

    The controller shall not rely solely on a general declaration of compliance or on standard contractual terms supplied by the data provider. Verification shall be strengthened where the circumstances of the processing give rise to reasonable doubt as to the lawfulness of the collection or of the making available of the data, in particular where the data originate from an undisclosed or indeterminate source, where they concern a large number of data subjects, or where they have been obtained through successive transfers.

    Where the controller is unable to demonstrate that lawfulness, it shall refrain from processing or from continuing to process the data concerned, and from selling them or making them available to third parties.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 5 – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 2a (new)
  2. 1001 Addition Axel VossEPP · ITRE–LIBE “The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this…”

    2a. In Article 5, the following paragraph is added:

    The principles of this Regulation relating to the protection of personal data shall be interpreted in such a way that the requirements of this Regulation are proportionate to the purpose for which they are intended and, in particular, take into account the varying likelihood and severity of the risk that data processing poses to the rights and freedoms of natural persons (risk-based approach). Measures taken to protect personal data must strike a fair balance with the interests or fundamental rights and freedoms of persons other than the data subject."

    Justification

    INNOVATION PACKAGE #1: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 5 – paragraph 2a (new)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 2a (new)

Paragraph 3Not amended by the Commission2 proposals

  1. 238 Addition Ton Diepeveen +1PfE · JURI “This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of…”

    2a. After Article 5(3), the following subparagraph is added

    This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Targets
    GDPR Article 5 – paragraph 3
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 3
  2. 360 Addition Virginie JoronPfE · IMCO “This paragraph shall not apply if the subscriber or user is a natural person and the information stored or accessed constitutes the processing of…”

    2a. The following subparagraph is added after Article 5(3)

    This paragraph shall not apply if the subscriber or user is a natural person and the information stored or accessed constitutes the processing of personal data.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 5 – paragraph 3
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 3

Paragraph 3, subparagraphNot amended by the Commission

  1. 1010 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of…”

    2b. After Article 5, paragraph 3, the following subparagraph is added

    This paragraph shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes the processing of personal data.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 5 – paragraph 3 – subparagraph
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 b (new) / Regulation (EU) 2016/679 / Article 5 – paragraph 3 – subparagraph

Paragraph 3aNot amended by the Commission

  1. 1003 Addition Angelika Niebler +1EPP · ITRE–LIBE “The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective…”

    In Article 5, the following paragraph 3 is added

    The principles and obligations laid down in this Regulation shall be applied and interpreted in a manner that is commensurate with the objective pursued by the provision concerned, that restricts the free movement of personal data no further than is necessary, and that gives due weight to the interests and to the fundamental rights and freedoms of persons other than the data subject.'

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Targets
    GDPR Article 5(3a)
    Document
    ITRE–LIBE amendments 777–1052 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 2 a (new) / Regulation (EU) 2026/679 / Article 5 – paragraph 3a (new)