Chapter I — General provisions
Chapter II — Principles
Chapter III — Rights of the data subject
Chapter IV — Controller and processor
Chapter V — Transfers of personal data to third countries or international organisations
Chapter VI — Independent supervisory authorities
Chapter VII — Cooperation
Chapter VIII — Remedies, liability and penalties
Chapter IX — Implementing acts
Chapter X — Final provisions
Recitals 41 / 107
Where the controller requests the provision of additional information necessary to confirm the identity of the data subject, that information should be processed only for that specific purpose and should not be stored for longer than needed for that purpose.