# Lawfulness of processing 6(4) — GDPR — provision context

> Focused context for a single provision (6(4)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-6#par-4
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Lawfulness of processing** (GDPR, full article: https://overview.legal/laws/gdpr/art-6).

## Provision text

### 6(4)

Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
d) the possible consequences of the intended further processing for data subjects;
e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

## Topics on this provision

- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Consent** — https://overview.legal/topics/toestemming
  Freely given, specific, informed indication of data subject wishes

## Cited by (exact-provision citations)

- **BVwG - W256 2227693-1** (case-law) — https://overview.legal/posts/125664
- **Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment** (case-law) — https://overview.legal/posts/132343
- **Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers** (case-law) — https://overview.legal/posts/132311
- **BVwG - W258 2227269-1/39E** (case-law) — https://overview.legal/posts/184564
- **Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation** (case-law) — https://overview.legal/posts/125666
- **VwGH - VwGH Ro 2025/04/0007-7** (case-law) — https://overview.legal/posts/184547
- **Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai** (case-law) — https://overview.legal/posts/132293
- **Judgment of the Court (First Chamber) of 20 October 2022.#Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(b) and (e) – Principle of ‘purpose limitation’ – Principle of ‘storage limitation’ – Creation, from an existing database, of a datab** (case-law) — https://overview.legal/posts/132306
- **Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers** ¶105 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132311
- **Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers** ¶202 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132311
- **Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers** ¶198 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132311
- **Judgment of the Court (First Chamber) of 20 October 2022.#Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(b) and (e) – Principle of ‘purpose limitation’ – Principle of ‘storage limitation’ – Creation, from an existing database, of a datab** ¶45 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132306

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-6#par-4 · 2026-08-22