Purpose Specification and Use Limitation

Purpose Specification and Use Limitation (CDPSE – Data Life Cycle Management)

Introduction
Purpose Specification and Use Limitation are two closely related privacy principles. They govern why personal data is collected and what it may be used for across its life cycle. They come from the OECD Privacy Guidelines (1980, updated 2013) and appear in GDPR Article 5(1)(b), ISO/IEC 29100, the APEC Privacy Framework, the Fair Information Practice Principles (FIPPs) and many national laws.

In the ISACA CDPSE exam, these principles fall under the Data Life Cycle domain. They also link to Privacy Governance and Privacy Architecture. Expect scenario-based questions in which an organization wants to reuse data, share it, or collect more than it needs, and you must pick the best privacy-preserving response.

Why It Is Important
1. Foundation of lawful processing. Most privacy laws say data must be collected for specified, explicit and legitimate purposes. It must not be processed further in ways incompatible with those purposes. Processing without a defined purpose is generally unlawful.

2. Prevents function creep. Function creep (also called scope creep or mission creep) is the gradual expansion of data use beyond its original intent. For example, CCTV footage collected for safety may later be used for employee productivity monitoring. These principles act as a brake on this drift.

3. Builds trust and transparency. Data subjects share data based on what they were told. Using it for something else breaks that trust and can cause reputational damage, regulatory fines and loss of customers.

4. Drives other principles. The stated purpose determines several other things:

• What data is necessary (data minimization)
• How long data is kept (storage limitation and retention)
• Who may access it (access control)
• Which lawful basis applies

Without a clear purpose, none of these can be measured.

5. Reduces risk. Limiting use limits exposure. Data that is not used for extra purposes is not copied to extra systems, analytics platforms or third parties. This shrinks the attack surface and the impact of any breach.

What It Is
Purpose Specification Principle (OECD): The purposes for which personal data are collected should be specified not later than at the time of data collection. Subsequent use should be limited to the fulfilment of those purposes, or others that are not incompatible with them and are specified on each change of purpose.

Use Limitation Principle (OECD): Personal data should not be disclosed, made available or otherwise used for purposes other than those specified, except (a) with the consent of the data subject, or (b) by the authority of law.

GDPR equivalent: Article 5(1)(b), the purpose limitation principle, says data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing for archiving in the public interest, scientific or historical research, or statistics is not considered incompatible, provided safeguards such as pseudonymization are in place (Article 89).

Key elements:

• Specified: The purpose is clearly defined. Vague wording such as "to improve services" or "for business purposes" is usually insufficient.
• Explicit: The purpose is communicated, typically through a privacy notice, and documented, for example in the record of processing activities (RoPA).
• Legitimate: The purpose is lawful and has a valid legal basis.
• Timely: The purpose is defined at or before collection, not invented afterward.
• Compatible use only: Secondary uses must be compatible with the original purpose. If not, they need new consent or another legal basis.

How It Works in Practice
1. Define purposes before collection. During project initiation, the business owner states why personal data is needed. This is captured in a Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA). Privacy by design requires this step early in the system development life cycle (SDLC).

2. Document purposes. Purposes are recorded in:

• Data inventories and data maps
• The RoPA
• Data classification schemes
• Metadata tags attached to data elements

3. Communicate purposes. Privacy notices, consent forms and just-in-time notices tell data subjects how their data will be used. Notice must happen at or before collection.

4. Link purpose to legal basis. Each purpose maps to a lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests.

5. Enforce use limitation technically. Common controls include:

• Role-based or attribute-based access control (RBAC/ABAC) tied to purpose
• Purpose-based access control, where requests must state a purpose that matches allowed purposes
• Data tagging and labeling with purpose metadata
• Segregation of datasets by purpose
• Data loss prevention (DLP) tools
• Logging and monitoring to detect unauthorized use
• Pseudonymization or anonymization before secondary analytics
• Consent management platforms that record and enforce consent preferences

6. Enforce use limitation contractually. Data processing agreements with vendors and processors restrict them to processing only on documented instructions and only for the specified purposes. Data sharing agreements with third parties should state permitted uses and prohibit onward use.

7. Manage changes of purpose. When a new use is proposed, the organization performs a compatibility assessment. Under GDPR Article 6(4), it considers:

• The link between the original and new purposes
• The context of collection and the relationship with data subjects
• The nature of the data, especially special categories
• Possible consequences for data subjects
• Existing safeguards such as encryption or pseudonymization

If the new use is incompatible, the organization must obtain fresh consent, rely on a legal requirement, or not proceed. Notices are updated and a new or revised PIA is performed.

8. Tie to retention and disposal. When the purpose is fulfilled, data should be deleted, anonymized or archived according to the retention schedule. Keeping data "just in case" violates the spirit of purpose limitation.

9. Audit and review. Periodic reviews confirm that actual data use matches documented purposes. Internal audit, privacy office reviews and access recertifications all support this.

Relationship to Other Principles

• Collection Limitation / Data Minimization: Collect only what is necessary for the specified purpose.
• Data Quality: Data should be relevant to the purpose.
• Openness / Transparency: Purposes must be disclosed.
• Security Safeguards: These protect against unauthorized use.
• Accountability: The organization must demonstrate compliance.
• Storage Limitation: Retention is bounded by the purpose.

Common Scenarios

• A marketing team wants to use customer support call records to train a sales AI model. This is a secondary use, so a compatibility assessment is required and likely new consent or notice.
• HR wants to use badge access logs (collected for physical security) to track employee attendance. This is function creep and needs assessment, notice and possibly works council or legal review.
• A hospital wants to share patient data with researchers. Research is a recognized compatible purpose under some laws if safeguards apply, such as de-identification and ethics approval.
• A vendor uses client data to improve its own products. This violates processor use limitation unless contractually permitted.
• Law enforcement requests data. This is an exception permitted by authority of law.

Exam Tips: Answering Questions on Purpose Specification and Use Limitation
1. Look for the earliest, most preventive control. CDPSE favors privacy by design. If a question asks what should be done FIRST when designing a new system, the answer is often to define and document the purpose of processing, or to conduct a PIA, before choosing technical controls.

2. Recognize secondary use red flags. Watch for phrases such as "wants to use existing data for a new initiative," "repurpose," "monetize customer data," "share with a partner," or "use for analytics." The best answer usually involves:

• Assessing compatibility with the original purpose
• Performing or updating a PIA/DPIA
• Obtaining consent, or confirming another legal basis
• Updating the privacy notice

3. Consent or law are the classic exceptions. Under the OECD Use Limitation principle, the only exceptions to using data beyond its specified purpose are the data subject's consent or authority of law. If an answer choice relies on business convenience or management approval alone, it is wrong.

4. Management approval is not enough. A senior executive approving a new use does not make it lawful. Choose answers that address the data subject's rights and legal requirements.

5. Anonymization can enable secondary use. Truly anonymized data is generally outside the scope of privacy law. If the goal is analytics or research, anonymizing first (or pseudonymizing with safeguards) is often the best answer. Remember that pseudonymized data is still personal data under GDPR.

6. Distinguish the principles.

• Purpose specification is about defining and declaring why data is collected.
• Use limitation is about restricting use and disclosure to those purposes.
• Collection limitation / minimization is about how much data is collected.
• Storage limitation is about how long data is kept.

Questions may test whether you can identify which principle is violated.

7. Vague purposes are a weakness. If a privacy notice states purposes like "any business purpose," the best recommendation is to make purposes specific and explicit.

8. Processors are bound by the controller's purposes. If a vendor uses data for its own purposes, the vendor effectively becomes a controller and breaches the contract. The best control is a data processing agreement with clear use restrictions, plus audit rights.

9. Technical enforcement supports, but does not replace, governance. Access controls, tagging and DLP enforce use limitation. However, the root requirement is a documented purpose and policy. If asked what is MOST important, governance and documentation usually come before tools. If asked how to ENFORCE, choose the technical control.

10. Tie purpose to retention. When a question states that the purpose has been fulfilled, the best answer is typically secure deletion or anonymization according to the retention schedule, not indefinite archiving.

11. Watch for keywords. FIRST, BEST, MOST important and PRIMARY change the answer. For example:

• FIRST step for a new use: assess compatibility or perform a PIA.
• BEST control to prevent misuse: purpose-based access control.
• PRIMARY reason for the principle: to protect data subjects' expectations and prevent function creep.

12. Think from the data subject's perspective. Ask whether the data subject would reasonably expect this use, given what they were told. If not, the use is likely incompatible.

Quick Memory Aid
Specify, Explicit, Legitimate, Limit (SELL): Specify purposes before collection, make them Explicit in notices, ensure they are Legitimate with a legal basis, and Limit use to those purposes unless there is consent or law.

Summary
Purpose Specification requires organizations to define, document and communicate why personal data is collected, at or before collection. Use Limitation ensures the data is used and disclosed only for those purposes, unless there is consent or legal authority. Together they prevent function creep, support data minimization and retention, and underpin lawful, transparent processing. On the CDPSE exam, favor answers that define purposes early, assess compatibility for new uses, obtain consent or confirm a legal basis, update notices, and enforce restrictions through both governance and technical controls.