Skip to content
CyberGuardCyberGuard Docs

Purposes

A purpose answers the “why” of a processing activity and names the ground that makes it lawful. Purpose limitation is one of the core data-protection principles: data collected for one declared purpose cannot quietly be reused for another. Recording purposes explicitly is what lets you demonstrate that limitation, and it is the field a supervisory authority reads first.

Where to find it

Section titled “Where to find it”

Privacy → Purposes in the sidebar lists every purpose across the domains you can see. Add Purpose creates one; you can also add purposes from the Purposes tab of a processing.

The entry

Section titled “The entry”

Every purpose belongs to exactly one processing and inherits its domain — you cannot create a free-floating purpose, so create the processing first. A single processing can carry several purposes, which is the normal case: a customer database is usually kept both to perform a contract and to meet a retention obligation.

FieldNotes
ProcessingRequired — the activity this purpose justifies
Custom nameOptional. When blank, the purpose displays as its legal basis
DescriptionThe business reason, in plain language
Legal basisThe Article 6 ground
Article 9 conditionRequired in practice whenever the processing touches special-category data

Legal basis (Article 6)

Section titled “Legal basis (Article 6)”
  • Consent
  • Performance of a Contract
  • Compliance with a Legal Obligation
  • Protection of Vital Interests
  • Performance of a Task in the Public Interest
  • Legitimate Interests

Article 9 conditions

Section titled “Article 9 conditions”

When the activity involves special-category data — health, biometrics, racial or ethnic origin, political opinions, trade-union membership, sexual orientation — an Article 6 basis is not enough on its own. The Article 9 condition field adds the second ground: Explicit Consent for Special Categories, Employment and Social Security Law, Vital Interests when the subject is physically or legally incapable, Processing by Nonprofit Organization, Data Manifestly Made Public by the Data Subject, Establishment/Exercise or Defense of Legal Claims, Substantial Public Interest, Preventive or Occupational Medicine, Public Health, or Archiving, Research or Statistical Purposes.

Working with the register

Section titled “Working with the register”

The list shows Legal basis, Description, Custom name and Processing, and filters by processing and by legal basis. Filtering on Consent is the fastest way to build the inventory of activities where a withdrawal of consent has to stop something — the list you need when a data subject exercises that right.

Keep purposes narrow. “Customer relationship management” covering billing, marketing and analytics at once defeats the point; three purposes with three legal bases gives you an honest record and a much easier answer when someone objects to only one of them.

Section titled “Related”