[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-purpose-limitation::en":3,"gloss-cluster-purpose-limitation::en":26,"gloss-next-purpose-limitation::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"purpose-limitation","security","Purpose Limitation","Purpose limitation is the principle that personal data collected for one stated purpose may not simply be reused for a different one. Under the GDPR it is one of the core principles: purposes must be specified and legitimate at the point of collection, and further processing must be compatible with them. It is a constraint on what you may do with data you already hold lawfully, which is what makes it easy to trip over.\n\nAI development is where organisations most often meet it. A support archive was collected to answer tickets, a call recording to resolve a dispute, a set of documents to deliver a service. Using any of them to train or fine-tune a model, or to build a retrieval index that answers unrelated questions, is a new purpose — and the fact that the data is already in your systems and the project is internal does not make it the same one.\n\nThe compatibility test turns on things a product team can reason about. How closely the new purpose relates to the original. The relationship and expectations of the people involved. The sensitivity of the data. Whether the new use could have consequences for those people. Whether safeguards such as removing identifiers reduce the impact. Some reuse passes that test comfortably; some plainly does not and needs a different basis, or fresh consent, or a different dataset.\n\nThe practical failure is not usually a decision to ignore the principle. It is that nobody notices a purpose has changed, because the data never moved: an index quietly gains a new source, a model is fine-tuned on production transcripts, an analytics pipeline starts feeding a recommendation feature. Nothing in the deployment looks like a new collection of data, so nothing triggers the review that would have caught it.\n\nThe defences are boring and effective. Record the purpose alongside the dataset rather than in a separate register. Make purpose an explicit field when a new source is added to a retrieval or training pipeline. And treat provider-side terms as part of the same question — sending data to a vendor that may use it to improve its own models is a further purpose you have to be able to account for.","Purpose limitation says data collected for one purpose cannot simply be reused for another. AI teams meet it when an old archive becomes training or index data.",null,[11,14,17,20,23],{"slug":12,"name":13},"data-minimization","Data Minimization",{"slug":15,"name":16},"data-processing-agreement","Data Processing Agreement (DPA)",{"slug":18,"name":19},"gdpr","GDPR (General Data Protection Regulation)",{"slug":21,"name":22},"pii","Personally Identifiable Information (PII)",{"slug":24,"name":25},"training-data-opt-out","Training Data Opt-Out",[27,31,34,37,40,43,46,49,53,56,59,62],{"slug":28,"category":5,"name":29,"updated_at":30},"access-review","Access Review","2026-09-08T21:32:37+00:00",{"slug":32,"category":5,"name":33,"updated_at":30},"ai-governance","AI Governance",{"slug":35,"category":5,"name":36,"updated_at":30},"ai-incident-reporting","AI Incident Reporting",{"slug":38,"category":5,"name":39,"updated_at":30},"ai-review-board","AI Review Board",{"slug":41,"category":5,"name":42,"updated_at":30},"ai-risk-tiering","AI Risk Tiering",{"slug":44,"category":5,"name":45,"updated_at":30},"ai-system-inventory","AI System Inventory",{"slug":47,"category":5,"name":48,"updated_at":30},"ai-usage-policy","AI Usage Policy",{"slug":50,"category":5,"name":51,"updated_at":52},"audit-log","Audit Log (Audit Trail)","2026-09-08T21:32:36+00:00",{"slug":54,"category":5,"name":55,"updated_at":52},"blast-radius","Blast Radius",{"slug":57,"category":5,"name":58,"updated_at":52},"break-glass-access","Break-Glass Access",{"slug":60,"category":5,"name":61,"updated_at":52},"bridge-letter","Bridge Letter",{"slug":63,"category":5,"name":64,"updated_at":52},"business-associate-agreement","Business Associate Agreement (BAA)"]