While the purpose of the research study should be as specific as possible, it may not be known definitively at the time of data collection, and some flexibility is allowed. Therefore, the GDPR allows a broader formulation of the purpose of the study, for example, specifying the discipline or the field of research.
The purpose of the study must be distinguished from the purpose of other activities that support research. For example, if researchers know people’s contact details through a consent form, they are not allowed to invite them to a new research project based on those contact details without prior consent. Similarly, the same data must not be used in the following project unless the subjects have been specifically informed. According to the interpretation of the GDPR, the secondary use of data for research purposes is allowed, but the data subject must be informed (see 2.8).
If the study has more than one purpose, and consent is the legal basis for the processing, it must be asked separately for each purpose.