Art. 5 DSGVO

Art. 5 GDPR is the foundation of European data protection law. The principles in it apply to every processing of personal data – including data that remains on retired laptops, servers and smartphones. Here you can read which principles exist and what they mean for IT retirement.

What does Art. 5 GDPR say?

Art. 5(1) GDPR names six principles; paragraph 2 adds accountability. The principles are not a non-binding mission statement. Violations can be punished under Art. 83(5) GDPR with the highest fines of the regulation.

Principle	In short	Relevance for IT retirement
a) Lawfulness, fairness, transparency	Processing only with a legal basis and in a traceable manner	Erasure by service providers is also processing
b) Purpose limitation	Use data only for specified purposes	Legacy data on devices must not be reused "on the side"
c) Data minimization	As little data as necessary	No copies of old hard drives "for safety" without a purpose
d) Accuracy	Data factually correct and up to date	Little direct relevance
e) Storage limitation	Do not store longer than necessary	Do not store old devices with data in the basement for years
f) Integrity and confidentiality	Protection against unauthorized access, loss and destruction	Secure storage, transport and erasure
Para. 2 – Accountability	Be able to demonstrate compliance	Erasure and destruction certificates per serial number

What does Art. 5 GDPR mean for retired IT?

Three principles are in the foreground when retiring devices. The Storage limitation requires that data be erased as soon as it is no longer needed and no retention period stands in the way. A retired device with customer data in storage quickly violates this principle.

Integrity and confidentiality require protection through appropriate technical and organizational measures. This is made concrete in Art. 32 GDPR: lockable collection containers, controlled transport, reliable erasure methods.

the Accountability finally reverses the burden of proof. It is not the authority that has to prove a violation, but you who must show that you comply with the principles. For old devices this means: records and certificates that can be assigned to each device. Which information such documentation should contain is described in our guide Certificate of destruction and erasure report.

Typical mistakes when retiring devices

• Old devices are collected without an erasure policy and remain lying around for months.
• "Formatting" is understood as erasure, although data remains recoverable.
• Documentation exists only as a collective receipt with weight, not per device.
• Nobody is responsible for retirement, so gaps go unnoticed.

How to hand over data carriers in a legally compliant way overall is shown in the guide Disposing of data carriers in GDPR-compliant fashion. This entry does not replace legal advice.

Art. 5 GDPR in practice at Second IT

Second IT supports the principles with documented processes: pickup with its own secure logistics without interim storage, checking of all devices for storage media at goods receipt, access control and video surveillance in the processing areas. Erasure is carried out with Blancco, with a digitally signed erasure certificate for each device. More on Data security at Second IT.

Frequently asked questions about Art. 5 GDPR

Which principles does Art. 5 GDPR name?

Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation and integrity and confidentiality. In addition, paragraph 2 adds the accountability of the controller.

How high can a fine be for violations of Art. 5 GDPR?

Violations of the principles fall under Art. 83(5) GDPR. Fines of up to 20 million euros or up to 4% of worldwide annual turnover of the preceding year are possible, whichever is higher. The authority takes the circumstances of the individual case into account.

Does Art. 5 GDPR also apply to defective devices?

Yes. Data can also be readable on defective hard drives or smartphones. As long as personal data resides on them, the principles apply. Defective data carriers that cannot be erased are therefore physically destroyed.

What does accountability mean under Art. 5 GDPR?

You must be able to demonstrate at any time that you comply with the principles. The burden of proof lies with you, not with the authority. For old devices this means: erasure and destruction certificates that can be assigned to each device via the serial number.

What is the difference between Art. 5 and Art. 32 GDPR?

Art. 5 names the principles of processing, for example integrity and confidentiality. Art. 32 turns these into concrete security measures. When retiring devices, these are for example lockable collection containers, controlled transport and reliable erasure methods.