The essence of the principle of purpose limitation is described in Art. 5(1)(b) GDPR and also contains the listing of preapproved compatible purposes.

Art. 5(1)(e) GDPR provides further details on the possible storage period of data relating to further processing for the preapproved compatible purposes.

Recital 50 GDPRprovides guidance for the interpretation of further processing for compatible purposes. Of particular interest is the second sentence that states that no additional legal basis separate from that which allowed the collection of the personal data is required.

Art. 89 GDPR mandates that when processing further for preapproved compatible purposes, controllers must implement adequate safeguards. It also opens to the possibility that in this context, Union or Member State law may provide for derogations from certain data subject rights.