CLAIM-2026-09-04-08

GDPR Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and Article 5(2) makes the controller responsible for demonstrating compliance with that principle.

Why it matters

Necessity under 5(1)(c) attaches to the operation, and 5(2) puts the burden of demonstrating it on the controller. A per-session cost figure does not discharge a per-operation test.

Sources

• intersoftco2026art