Art. 5 of the GDPR sets out the various basic principles for data processing. These regulate how the storage and processing of data can take place in accordance with the law.

• Lawfulness of processing
  A legal basis is a prerequisite for any data processing.
• Purpose limitation
  When collecting data, the purpose for the collection must be defined and communicated to the data subject. It must be legitimate and unambiguous and may not be used for any other purpose. The data subject must be informed of any subsequent changes. In addition, the data subject is given a right of objection with the change, if applicable.
• Data minimization
  Only the data that is actually necessary to achieve the purpose should be collected. This means that for a reservation in a restaurant, the date of birth or marital status need not be requested.
• Accuracy
  All data must be factually correct and always up to date. This means that all outdated data must be deleted or modified immediately.
• Storage limitation
  Data may only be stored as long as it is necessary to achieve the purpose.
• Integrity and confidentiality
  The collected data must be adequately protected against unauthorized or unauthorized processing, but especially against disclosure to unauthorized third parties or accidental loss. The appropriate technical and organizational measures must be introduced for this purpose.
• Accountability
  The controller who collects the data is responsible for compliance with the above points and must also be able to demonstrate this to the supervisory authorities.