The General Data Protection Regulation establishes a comprehensive framework for the protection of personal data, and Article 5 of the GDPR lays down the fundamental principles that govern the processing of personal data. These principles act as the foundation of data protection law and guide organizations in collecting, storing, and using personal information in a responsible and lawful manner. The first principle is lawfulness, fairness, and transparency. Personal data must be processed in a lawful manner based on a valid legal ground such as consent, contract, legal obligation, vital interests, public task, or legitimate interests. Fairness requires that processing should not be deceptive or unjust to individuals, while transparency mandates that data subjects are clearly informed about how their data is collected, used, shared, and retained, usually through privacy notices written in clear and accessible language. The second principle is purpose limitation. Under this principle, personal data must be collected for specified, explicit, and legitimate purposes and should not be further processed in a manner that is incompatible with those purposes. This ensures that organizations do not misuse data by employing it for unrelated activities without proper justification or additional consent. Closely related to this is the principle of data minimization, which requires that personal data collected should be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Organizations should avoid excessive data collection and regularly assess whether all data being held is truly required. The fourth principle is accuracy. Personal data must be accurate and, where necessary, kept up to date. Reasonable steps must be taken to ensure that inaccurate personal data is erased or rectified without delay. This principle recognizes that incorrect data can lead to unfair decisions, financial loss, or reputational harm for individuals, and therefore places an obligation