Reusing personal data you already hold to train or run a new AI system is one of the most common — and most overlooked — GDPR risks. The AI Purpose Limitation Compatibility Checker walks you through the Article 6(4) compatibility factors to gauge whether your new AI use is likely compatible with the purpose the data was originally collected for.
What purpose limitation actually means
Article 5(1)(b) of the GDPR states that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Article 6(4) then specifies the five factors you must weigh to determine compatibility.
This matters especially for AI because data that was collected for one clearly defined purpose — say, fulfilling a purchase order — is routinely being reconsidered for training recommendation engines, fine-tuning chatbots, or building fraud-detection models. None of those new uses are self-evidently compatible with the original collection purpose, and many require a separate lawful basis.
How it works
You describe the original collection purpose and the new AI use, then answer a short set of factor questions drawn directly from Article 6(4): how closely the purposes are linked, the context in which the data was collected, whether special-category (sensitive) data is involved, the possible consequences for individuals, and whether safeguards such as pseudonymisation apply.
The tool weighs these factors — sensitive data and severe consequences pull strongly toward “incompatible,” while a close purpose link and strong safeguards pull toward “compatible” — and returns a likely-compatible, borderline, or likely-incompatible assessment with the reasoning.
The five Article 6(4) factors, explained
Understanding why each factor matters helps you answer the questions accurately:
1. Link between purposes. A customer-service chat log used to improve customer-service AI has a clear, direct link. That same data used to train a credit-risk model has almost none. The closer the functional relationship, the more the scale tips toward compatible.
2. Context of collection. What would a reasonable person have expected at the moment they shared the data? If they used a checkout form, they expected delivery logistics, not model training. This “reasonable expectations” test is often the most intuitive factor.
3. Nature of the data. Special-category data — health, biometric, racial or ethnic origin, political opinions, sexual orientation — creates an almost-automatic incompatibility finding for new AI uses. The bar for reusing this data is extremely high.
4. Possible consequences. If the new AI use could lead to decisions that significantly affect individuals — creditworthiness, insurance pricing, employment — the consequences factor pulls hard toward incompatible. If the use is purely internal and analytical with no decision-making impact, it pulls the other way.
5. Safeguards. Pseudonymisation, encryption, access controls, and contractual restrictions on secondary use can pull a borderline case toward compatible. They do not convert a fundamentally incompatible use into a compatible one, but they are meaningful for close calls.
What the result means in practice
A “likely compatible” result suggests the new processing may rely on the original lawful basis, subject to transparency and (often) a DPIA. A “likely incompatible” result signals that you probably need a fresh lawful basis — typically explicit consent — before proceeding. A “borderline” result means the factors conflict and you need a documented, reasoned assessment rather than a quick judgement.
Tips and notes
The factor that most often flips a result is the nature of the data: reusing special-category data (health, biometric, political opinion) for a new AI purpose is rarely compatible without explicit consent. The second is reasonable expectations — would the individual, at the point of collection, have expected this AI use? Document your reasoning either way; the ability to show your working is itself a GDPR accountability obligation. This is a heuristic, not legal advice, and everything runs in your browser.