Reusing personal data you already hold to train or run a new AI system is one of the most common — and most overlooked — GDPR risks. The AI Purpose Limitation Compatibility Checker walks you through the Article 6(4) compatibility factors to gauge whether your new AI use is likely compatible with the purpose the data was originally collected for.
How it works
You describe the original collection purpose and the new AI use, then answer a short set of factor questions drawn directly from Article 6(4): how closely the purposes are linked, the context in which the data was collected, whether special-category (sensitive) data is involved, the possible consequences for individuals, and whether safeguards such as pseudonymisation apply.
The tool weighs these factors — sensitive data and severe consequences pull strongly toward “incompatible,” while a close purpose link and strong safeguards pull toward “compatible” — and returns a likely-compatible, borderline, or likely-incompatible assessment with the reasoning.
What it tells you
A “likely compatible” result suggests the new processing may rely on the original lawful basis, subject to transparency and (often) a DPIA. A “likely incompatible” result signals that you probably need a fresh lawful basis — typically consent — before proceeding. A “borderline” result means the factors conflict and you need a documented, reasoned assessment rather than a quick judgement.
Tips and notes
The factor that most often flips a result is the nature of the data: reusing special-category data (health, biometric, political opinion) for a new AI purpose is rarely compatible without explicit consent. The second is reasonable expectations — would the individual, at the point of collection, have expected this AI use? Document your reasoning either way; the ability to show your working is itself a GDPR accountability obligation. This is a heuristic, not legal advice, and everything runs in your browser.