There are seven principles of GDPR, set out in Article 5 of the UK GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. The ICO calls them the heart of the law and says breaking them can bring the highest tier of fine. The Lift College GDPR Training course covers the seven principles in practice.
1. Lawfulness, fairness and transparency
Personal data must be processed lawfully, fairly and in a transparent way. In practice: have a lawful basis, do not use data in ways people would not expect, and tell them clearly what you do with it.
2. Purpose limitation
Collect data for specified, explicit and legitimate purposes, and do not use it later in a way that is incompatible with them. The ICO updated its guidance on this principle on 23 March 2026 to reflect the Data (Use and Access) Act 2025.
3. Data minimisation
Data must be adequate, relevant and limited to what is necessary. In practice: do not collect fields you do not need.
4. Accuracy
Data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to correct or erase inaccurate data without delay.
5. Storage limitation
Do not keep data in a form that identifies people for longer than you need it. The ICO says you should be able to justify how long you keep data, set standard retention periods where you can, and review and erase or anonymise data you no longer need.
6. Integrity and confidentiality (security)
Protect personal data with appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage.
7. Accountability
The organisation is responsible for complying with the other six principles and must be able to show that it does, for example with policies, records and training.
Why they matter
The ICO says the principles "lie at the heart of the UK GDPR" and have very limited exceptions. Infringing the basic principles falls in the highest tier of administrative fines: up to £17.5 million, or 4% of total worldwide annual turnover, whichever is higher.
Training
Lift College GDPR Training is 2 hours in 5 modules, with a module on the seven principles in practice and a CPD Standards Office accredited certificate the same day you pass.