inaki-del-olmo-602632-unsplash

The lawful basis for Data Processing under the GDPR

A lawful (or legal) basis for processing data must be satisfied before a business can process any personal data. Article 6 of the GDPR describes six scenarios when you are allowed to process data legally. 

1. Data subject has given consent

The GDPR states that the individual’s consent must be:

  • freely and clearly given,
  • specific,
  • informed, and
  • unambiguous. 

It is important to know that consent must be distinguished from all other text, for the individual to understand what data is collected from them and how it is used.

Individuals must be given an option to refuse or withdraw their consent at any time and without penalty. The companies must obey the withdraw and stop processing the individuals’ data. 

The process of consent withdrawal needs to be done the same way as giving consent. It is the obligation of the company to demonstrate that the individual has given their consent to process their data.

If data is used for multiple purposes, then consent is required for every process separately.

2. There is an existing contract

The processing is necessary for the performance of a contract, or for taking steps at the request of the individual before entering into a contract. 

For example, when an individual wants to open a bank account, he or she is requested to fill out a form with his or her personal details. This counts as a pre-contractual processing. 

But, once the account is opened the bank would like to send you campaign offers as part of marketing activities, it needs to use your email address to be able to do so. In this situation, the bank must obtain your consent first to have a lawful basis. 

3. Processing is necessary for compliance with a lawful obligation

The controller is obliged to processing if it is required by the EU or EU Member State law. 

National laws may require companies to process personal data, for example, Estonian accounting law requires companies to preserve documents for 7 years, therefore the companies are bound by national laws to process data.

For public officials, legal obligation means that there is an official mission set for them by the law. For example, the tax department, police, and financial institutions are processing individuals’ personal data as it is their job. 

4. Processing is necessary in order to protect the vital interests

This processing is necessary to protect the individuals’ life or physical integrity when in danger (emergency medical care) and when the data subjects are not able to give consent. This should be used only as a last resort. 

For example, it is important that the ambulance staff can access the individuals’ medical data in case of an accident. Processing under vital interest is used mostly in extreme conditions and circumstances.

5. Processing is necessary for the performance of a task carried out in the public interest

The processing is necessary to perform a task in the public interest or of official functions, and the task or function has a clear basis in law.

Processing individuals’ data for the benefit of the public can be seen as public interest, for example, an outbreak occurred and the data processing can help with statistics and information flow. Processing data of a public figure is public interest when the interest of the public is high.

6. Processing is necessary for the purpose of the legitimate interests

The processing is necessary for companies interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

Legitimate interest may only be applied in situations, where there is a relevant and appropriate relationship between the individual and data processor.

Those situations can be for example a client and service provider relationship, where the client can reasonably expect that their data will be processed. When a company belongs to a group, transmitting the data between the group for internal administrative purposes is a legitimate interest.

Legitimate interest does not apply to public authorities processing personal data to perform their tasks.

Recording the lawful basis for each processing activity

According to the GDPR Article 30, the lawful basis should be recorded in the Record of Processing Activities.

The most simple way to manage and record all the processing activities is with a tool like GDPR Register. 

More to read on this topicRecords of processing activities in GDPR Article 30

 

Easy to use GDPR compliance tool

With GDPR Register you can keep a record of processing activities, create & manage documents, report to the Data Protection Agency.
Share on facebook
Share on linkedin
Share on twitter
Share on pinterest
Share on email

Get your compliance organized with proper GDPR tools.
Contact us for a demo and get access to 14-day trial.

Save time and be confident

Latest Posts
The EU-U.S. Data Privacy Framework: A Transatlantic honeymoon for data flows, but for how long?

The EU-U.S. Data Privacy Framework: A Transatlantic honeymoon for data flows, but for how long?

The European Commission concluded that the United States ensures adequate protection for personal data transferred from the EU to U.S....
A Comprehensive Guide to Personal Data Mapping

A Comprehensive Guide to Personal Data Mapping

Introduction Data privacy and security are of utmost concern in the digital era of today, especially when it comes to...
Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

What is a Data Processing Agreement (DPA)? A Data Processing Agreement (DPA) is a legally binding document to be entered...
Direct marketing rules and exceptions under the GDPR

Direct marketing rules and exceptions under the GDPR

Direct marketing includes text messages (SMS) and emails that a customer receives from a product or service provider. But activities...
Transmitting personal data to third countries

Transmitting personal data to third countries

The GDPR has put strict rules in place, when it comes to data transfer to third countries or international organizations. Which...
Records of processing activities in GDPR Article 30

Records of processing activities in GDPR Article 30

What are the records of processing activities (ROPA)? Article 30 of the EU General Data Protection Regulation (GDPR) requires organisations...
10 Great GDPR Software Tools for Compliance in 2023 (Review + Pricing)

10 Great GDPR Software Tools for Compliance in 2023 (Review + Pricing)

In this article, we will introduce you to some useful GDPR software tools which may help you reach GDPR compliance...
Personal Data Breach Reporting Requirements Under the GDPR

Personal Data Breach Reporting Requirements Under the GDPR

What is Data Breach? According to General Data Protection Regulation (GDPR), a personal data breach is a security incident that...
Data Protection Authorities (DPA)

Data Protection Authorities (DPA)

Data Protection Authorities (DPA) Data Protection Authorities (DPA) are independent public authorities that supervise, through investigative and corrective powers, the...
GDPR compliance checklist for controllers

GDPR compliance checklist for controllers

This is a simple GDPR compliance checklist for data controllers that you can use to ensure you have considered most important...