A software vendor processes citizen contact data under a city contract, then quietly re-uses those contacts to train its own commercial product. What GDPR-aligned limit does this violate most directly?
Select an answer to reveal the explanation.
Short Explanation
The city hired a helper, not a free-range data miner. Processors follow the controller's playbook—they don't remix citizen contacts into their own product lab just because the files were handy. Purpose limits and instructions still apply when a third party holds the data.
Full Explanation
Under GDPR, processors may process personal data only on documented instructions from the controller, and purpose limitation constrains further use. Re-using contracted city contact data for the vendor's own product training typically exceeds authorised purposes unless a separate, valid lawful basis and role arrangement cover that new processing—marketing claims in a policy do not substitute for those requirements.