The law establishes six grounds applicable to all processing of
all personal data. We must ensure that personal data shall:

• Be processed lawfully, fairly and transparently in relation to the
  data subject ("lawfulness, fairness and transparency")
  
  
• Be collected for specified, explicit and legitimate purposes and not be
  further processed in a manner incompatible with those purposes ("purpose limitation")
  
  
• Be adequate, relevant and limited to what is necessary for the purposes
  for which they are processed ("data minimization")
  
  
• Be accurate and, where necessary, kept up to date; every reasonable step must be
  taken to ensure that personal data that are inaccurate, having regard to the
  purposes for which they are processed, are erased or rectified without delay ("accuracy")
  
  
• Be stored in a form which permits identification of data subjects for no longer
  than is necessary for the purposes for which the personal data are processed ("storage limitation")
  
  
• Be processed in a manner that ensures appropriate security of the personal data,
  including protection against unauthorized or unlawful processing and against accidental
  loss, destruction or damage, using appropriate technical or organizational measures ("integrity and confidentiality")