Key takeaway
Describe the original purpose and the proposed use precisely, then record why the connection is defensible. An attractive receiving opportunity does not answer the compatibility question.
Start with the collection people actually experienced
A database description such as “customer interactions” tells a reviewer almost nothing about the permission to reuse it. Identify the version of the collection notice, the actual service, the relationship with the people concerned and the processing basis used at collection. A vendor contract, a revised website notice and a sales presentation are different pieces of evidence. Date them separately. Do not replace a missing historical notice with today’s broader wording.
For EU GDPR processing, Article 6(4) specifies a compatibility assessment where further processing is not based on the person’s consent or the qualifying Union or Member State law described there. Its factors concern purpose links, collection context, data nature, consequences and safeguards. The Commission explains that another use may be possible after checking compatibility. This is a conditional review, rather than permission to treat every existing record as a reusable asset.
Write the proposed purpose as an action: who will receive which fields, what they will do, which people may be affected and which outputs will leave their environment. “AI research” is too broad to compare with “resolve a customer’s delivery problem.” Ask for the receiving party’s concrete evaluation or product use before spending money preparing a sample.
A completed comparison, with a real hold decision
Hypothetical example: a retailer collected identifiable support tickets to resolve returns. A prospective recipient asks for ticket text to train an assistant that will be sold to unrelated retailers. The owner has the original notice and its lawful-basis record, but has not established authority for this new disclosure. The following record is an illustrative review agenda, not a finding that either use is lawful.
The useful output is a decision about the proposed scope, not a score averaged across five boxes. One serious unresolved issue can hold the release. In this example, separating nonpersonal product defect counts might support a different proposal, but it does not prove that free-text tickets are anonymous. The reviewer would need to assess what remains identifiable before treating that alternative differently.
| Factor | Evidence in this example | Recorded consequence |
|---|---|---|
| Purpose link | Returns resolution versus an external commercial assistant | Connection is weak; document the recipient’s actual training purpose. |
| Collection context | Customers sought help from their retailer | Do not assume an unrelated recipient was reasonably expected. |
| Nature | Ticket text includes names, addresses and occasional health references | Separate sensitive content and identify additional conditions that need review. |
| Consequences | Recipient proposes persistent model training and onward product sales | Ask how complaints, mistakes and future use would affect people. |
| Safeguards | Encryption and pseudonymous ticket IDs are proposed | These reduce particular risks; they do not settle the purpose question. |
| Decision | No defensible conclusion or alternative authority recorded yet | Hold identifiable tickets; reassess a narrower proposed use with qualified review. |
Do not use a new legal-basis label to skip the comparison
Recital 50 explains that compatible further processing need not require a legal basis separate from the one supporting collection. That does not turn compatibility into the only requirement, or make a new “legitimate interests” label a universal cure for an incompatible reuse. Record the reviewer’s treatment of the original basis, any relevant consent or law, transparency, sensitive data and other applicable constraints. A compatibility record should preserve that reasoning rather than announce a blanket clearance.
Keep four outcomes available: the proposed scope is supported; a narrower scope needs another assessment; an alternative permission route requires review; or the proposal should stop. Each outcome needs an owner, a dated evidence reference and a next action. Where the receiving party changes its purpose or intended audience, reopen the comparison against the changed proposal instead of carrying forward the earlier conclusion.
Use the rights review tool to assemble the missing materials and the introduction brief to describe the permitted conversation. VOID’s receiving-program-paid referral model has no upfront seller referral fee, but introduction permission remains separate from sample and licensing decisions. An introduction can discuss a record category while the records themselves stay withheld. This guide concerns EU GDPR purpose compatibility; it does not decide UK rules, sector restrictions, contract rights or a particular transaction’s lawfulness.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.