2 GDPR provisions stipulate that the controller must carry out compatibility assessments:

Art. 5 I b: “Personal data shall be collected for specified […] purposes and not further processed in a manner that is incompatible with those purposes […].”

 

Art. 6 IV: “Where the processing for a purpose other than that for which the personal data have been collected is not […] the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account […].”