A software vendor processes citizen contact data under a city contract, then quietly re-uses those contacts to train its own commercial product. What GDPR-aligned limit does this violate most directly?

Processors may process personal data only on documented instructions from the controller and within the authorised purposes. When a software vendor quietly re-uses city citizen contact data to train its own commercial product, it typically exceeds those instructions and violates purpose limitation as applied through the controller–processor relationship. The GDPR-aligned limit is that processors and contracted third parties must not self-repurpose personal data for their own product development absent a lawful basis and proper authorisation as controller (or a new, compatible arrangement).

The right of access does not impose a universal twenty-four-hour storage cap on contact fields; access timing rules are separate from secondary-use prohibitions. Adequacy decisions concern international transfer tools, not a blank licence for processor product training. Mentioning machine learning in a privacy policy does not authorise processing beyond the city’s instructions or create a lawful basis for the vendor’s independent commercial reuse.

Exam caveat: “we already hold the data under contract” is not permission for a new purpose owned by the processor. Operational check: review Article 28 terms, forbid product-training reuse without written authorisation, audit actual data flows, and require deletion or return of city data when the engagement ends. Civic contracts should treat citizen contacts as held in trust for municipal purposes, not as raw material for a vendor’s private model shop.