Data was collected to fulfil bookings. A team wants to use it to train a recommendation model. What determines whether that is permitted, and how is it enforced?

The question that governs it

What was the stated purpose at collection, and is the new use compatible with it? Data collected to perform a contract may not be freely repurposed for a different objective, and "we already have the data" is not a lawful basis.

Compatibility is assessed on the relationship between purposes, the subject's reasonable expectations, the sensitivity of the data, and the consequences for the individual — not on the technical convenience of the reuse.

What makes this enforceable rather than aspirational

• Purpose recorded with the data at collection, as metadata that travels with it. Without this, the question cannot be answered later at all, and the usual outcome is that nobody can determine what any historical dataset was collected for.
• Lawful basis recorded per purpose, since different purposes for the same data may rest on different bases, with different subject rights attached.
• Access granted per purpose, not per team. A team's access to a dataset should carry the purpose it was granted for.
• New uses reviewed against recorded purpose, as a gate in the process for creating a new pipeline or model, rather than as a periodic audit that finds it afterwards.
• Derived data inheriting purpose constraints through lineage — a model trained on purpose-limited data inherits the limitation, which is the step most often missed.

Why the enforcement point matters

Discovering a purpose violation in an audit means the model already exists and has been serving. Remediation then involves deleting the model, retraining without the data, and potentially notifying — all far more expensive than a check at the point the pipeline was proposed.

The organisational reality

The request will keep coming, so the answer needs to be a documented route to a lawful basis — a fresh consent, a legitimate interests assessment, or anonymisation to the point the rules no longer apply — rather than only a refusal. A control with no permitted path gets bypassed.