Secondary Use and Compatible Purposes (CDPSE: Data Life Cycle Management)
Overview
Secondary use means using personal data for a purpose other than the one for which it was originally collected. Compatible purposes are new purposes that are close enough to the original purpose that further processing may be allowed without fresh consent or a new legal basis.
In the CDPSE (Certified Data Privacy Solutions Engineer) exam, this topic sits within Data Life Cycle Management. It tests whether you can recognize when data is being repurposed, judge whether the new use is compatible, and choose the right technical and governance controls.
Why It Is Important
1. Purpose limitation is a core privacy principle. It appears in the OECD Privacy Guidelines, GDPR Article 5(1)(b), the APEC Privacy Framework, ISO/IEC 29100 and most modern privacy laws. Data collected for specified, explicit and legitimate purposes must not be further processed in ways incompatible with those purposes.
2. Function creep is a major source of privacy harm. Organizations often find new value in existing data, such as analytics, AI model training, marketing, profiling or sharing with partners. Without control, data quietly drifts into uses individuals never expected.
3. Regulatory and financial risk. Unlawful secondary use can lead to fines, enforcement orders, mandatory deletion of data or models (algorithmic disgorgement), litigation and reputational damage.
4. Trust and transparency. Using data in ways people would not reasonably expect damages customer trust, even where it may be technically legal.
5. Engineering impact. Privacy engineers must build systems that tag data with its purpose, enforce purpose-based access, and support assessment workflows before data is reused. This is privacy by design applied across the data life cycle.
What It Is: Key Concepts
Primary purpose: The specific, explicit purpose stated at collection, for example processing an order, delivering a service or meeting a legal obligation.
Secondary use (further processing): Any later use for a different purpose, for example using order data for targeted advertising or training a machine learning model.
Compatible purpose: A further purpose judged consistent with the original after a structured assessment.
Incompatible purpose: A further purpose that goes beyond what was disclosed or expected. It requires a new lawful basis, typically fresh consent, or must not happen at all.
Function creep / scope creep: The gradual, often undocumented expansion of data use beyond its original scope.
Purpose specification: Defining and documenting purposes before or at the time of collection.
Compatibility Assessment Factors (GDPR Article 6(4) model, widely used as best practice)
When the new processing is not based on consent or law, assess:
1. Link between purposes: How closely related is the new purpose to the original?
2. Context of collection: What is the relationship between the individual and the organization, and what would the individual reasonably expect?
3. Nature of the data: Are special categories involved (health, biometric, criminal, children's data)? Sensitive data makes compatibility much harder to justify.
4. Possible consequences for individuals: Could the new use cause harm, discrimination, profiling effects or loss of control?
5. Existence of appropriate safeguards: Encryption, pseudonymization, anonymization, aggregation, access restriction and minimization.
Commonly Recognized Compatible or Privileged Purposes
- Archiving in the public interest, scientific or historical research, and statistical purposes are generally presumed compatible under GDPR (Article 89), provided appropriate safeguards are in place, especially pseudonymization and minimization.
- Security, fraud prevention and service improvement closely tied to the original service are often compatible, depending on context.
- Uses required by law, such as regulatory reporting or court orders, have their own lawful basis.
Typically Incompatible Without New Consent
- Using customer service data for unrelated third-party marketing.
- Selling or sharing data with data brokers.
- Using employee monitoring data for unrelated performance profiling.
- Using health data collected for treatment for insurance pricing.
- Training AI models on personal data when this was not disclosed and would not be expected.
How It Works in Practice (Life Cycle View)
1. Collection stage: Define and document purposes clearly in the privacy notice and the record of processing activities (RoPA). Collect only what each purpose needs (data minimization). Where secondary uses are foreseeable, disclose them up front and obtain consent where needed.
2. Classification and tagging: Attach purpose metadata to datasets, such as purpose codes, consent flags and retention rules. This enables purpose-based access control (PBAC) and policy enforcement in data platforms.
3. Change request / new use proposal: Any new use of existing data triggers a governance workflow. The business owner submits the request, and the privacy office performs a compatibility assessment and, if risk is high, a Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA).
4. Decision outcomes:
- Compatible: Proceed. Document the rationale and update the RoPA and, if needed, the privacy notice.
- Compatible with safeguards: Proceed only after applying pseudonymization, aggregation, de-identification or access limits.
- Incompatible: Obtain fresh consent, identify another lawful basis, fully anonymize the data so it is no longer personal data, or reject the use.
5. Technical enforcement: Use data access governance tools, attribute-based access control, data loss prevention (DLP), data lineage tracking, and logging and monitoring to detect use outside the approved purpose.
6. Transparency: Inform individuals of the new purpose before processing begins, including their rights such as the right to object.
7. Retention and disposal: Secondary use does not justify keeping data indefinitely. Retention must match the approved purposes, and data must be securely deleted or anonymized when they are fulfilled.
8. Third parties and vendors: Contracts and data processing agreements must restrict processors to the controller's specified purposes and prohibit their own secondary use.
Role of De-identification
Anonymization: Truly anonymized data falls outside most privacy laws, which allows broader secondary use. However, re-identification risk must be assessed, for example through linkage attacks, k-anonymity and differential privacy.
Pseudonymization: This is a safeguard that supports a compatibility argument. The data is still personal data, so obligations still apply.
Exam Tips: Answering Questions on Secondary Use and Compatible Purposes
1. Identify the original purpose first. Read the scenario carefully: why was the data collected, and what were individuals told? Every answer depends on this baseline.
2. Look for the trigger. Phrases such as "the marketing team wants to use...", "the company plans to leverage existing data for analytics" or "data will be used to train a model" signal a secondary-use question.
3. Assessment comes before action. When a new use is proposed, the BEST FIRST step is usually to perform a compatibility assessment or PIA/DPIA, or to review the privacy notice and consent records. Avoid answers that jump straight to implementing the use or simply notifying users afterward.
4. Prefer governance plus technical safeguards. CDPSE is an engineering-focused exam. Strong answers often combine assessment with controls such as pseudonymization, minimization, purpose tagging and access restriction.
5. Consent is not always the answer. If the new purpose is compatible, fresh consent may not be required. If it is clearly incompatible, such as selling data or unrelated marketing, the answer usually involves obtaining new consent or a new lawful basis.
6. Sensitive data raises the bar. If health, biometric, financial or children's data is involved, lean toward stricter answers: DPIA, explicit consent and stronger de-identification.
7. Watch for anonymization traps. "Anonymized" data that can be re-identified is still personal data. Pseudonymization alone does not remove privacy obligations.
8. Reasonable expectations matter. If the scenario suggests users would be surprised by the use, it is likely incompatible.
9. Documentation is evidence of accountability. Answers involving updating the RoPA, documenting the compatibility rationale and updating privacy notices reflect accountability and are often correct supporting actions.
10. Distinguish roles. The data owner or business owner requests the use. The privacy officer or DPO advises and assesses. The privacy engineer implements controls. Processors may not repurpose data for their own ends.
11. Choose the MOST privacy-protective yet practical option. Between equally valid answers, pick the one that meets the business need while minimizing data exposure, for example using aggregated or de-identified data instead of raw personal data.
12. Remember life cycle linkage. Secondary use affects retention, disposal, sharing and access. If a question asks about keeping data longer "for future use", that usually conflicts with purpose limitation and storage limitation.
Sample Question Walkthrough
Scenario: A retailer collected customer addresses for delivery. The analytics team now wants to use purchase histories and addresses to build customer profiles for targeted advertising. What should the privacy engineer do FIRST?
Reasoning:
- The original purpose is order fulfillment.
- The new purpose is profiling for advertising. It is weakly linked to delivery, likely outside reasonable expectations, and carries a profiling risk.
- The best first step is to conduct a compatibility assessment or DPIA and review existing consent and the privacy notice. The likely outcome is that opt-in consent or a valid opt-out mechanism is needed, and that minimization is applied.
- Wrong choices would be: start profiling and update the notice later; anonymize addresses and proceed, which does not suit targeting; or rely on the original terms of service without assessment.
Key Takeaways
- Purpose limitation is the foundation, and secondary use is any deviation from the original purpose.
- Compatibility depends on the link between purposes, context and expectations, the nature of the data, the consequences for individuals, and the safeguards in place.
- Research, statistics and archiving get favorable treatment when safeguards are applied.
- Incompatible uses require new consent or another lawful basis, or must be rejected.
- Privacy engineers enforce purpose through tagging, access control, de-identification, logging and governance workflows.
- On the exam, assess first, protect with safeguards, document, and respect individuals' reasonable expectations.
