An organization based in Germany has appointed a Turkish citizen to its Amsterdam office.

Comprehensive and Detailed Explanation:

Under theGDPR,Purpose Limitationrefers to the principle that personal data must be collected forspecified, explicit, and legitimate purposesand not further processed in a manner incompatible with those purposes.

In this case, providinghealth dataduring school enrollment must be aligned with a clearly defined, legitimate reason—like ensuring medical safety for the child. Any processing beyond that intent may breach the purpose limitation.

GPHR Study Guide Extract – Workforce Relations and Risk Management / Global Compliance and Data Protection:

“The GDPR mandates that organizations must ensure that personal data is collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (purpose limitation). This principle is central to lawful data processing under EU law.”

This is distinct fromdata minimization(collecting only necessary data), which may also apply but isn't the primary concern here.