# Purpose limitation

URL: /systems/trust-and-governance/controls/purpose-limitation · Id: `control:purpose-limitation`

> Every field carries a data class, and a personal or confidential field is readable only for a Purpose it declares.

Every field carries a data class, and a personal or confidential field is readable only for a [Purpose](/business/nouns/purpose) it declares.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 P4.1](/systems/trust-and-governance/criteria/soc2/p4-1) | The entity limits the use of personal information to the purposes identified in its objectives. |
| [SOC2 C1.1](/systems/trust-and-governance/criteria/soc2/c1-1) | The entity identifies and maintains confidential information to meet its confidentiality objectives. |
| [ISO27001 A.5.34](/systems/trust-and-governance/criteria/iso27001/a-5-34) | Privacy and the protection of personal data meet applicable laws, regulations and contractual requirements. |
| [GDPR Art.5](/systems/trust-and-governance/criteria/gdpr/art-5) | Personal data is processed lawfully, fairly and transparently, for specified purposes, minimized, accurate, limited in storage and secure. |
| [GDPR Art.25](/systems/trust-and-governance/criteria/gdpr/art-25) | A controller builds data protection into processing by design and processes only necessary data by default. |

## Implemented by
- [Privacy](/workflows/processes/privacy)
- [Product definition](/workflows/processes/product-definition)
- [Privacy](/systems/privacy)
- [Permissions](/code/platform/permissions)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every read of a personal or confidential field in the report period. |
| Assert | Each read cites a Purpose the field declares, and every field has a data class. |

## Owner
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

## Example
A recruiting [SaaS](/products/templates/saas)'s `phone` field is personal and declares the scheduling Purpose. A marketing [Play](/business/nouns/play)'s read of it is refused.