What are the Lawful Bases of the GDPR and how do they apply to your business?…

There are 6 lawful bases for processing personal data under the UK GDPR (General Data Protection Regulation);

the lawful bases for processing personal data are outlined in Article 6, and they are as follows:

1. Consent: The individual has given clear consent for you to process their personal data for a specific purpose.
2. Contractual necessity: Processing is necessary for the performance of a contract to which the individual is a party or to take steps at the request of the individual prior to entering into a contract.
3. Legal obligation: Processing is necessary for compliance with a legal obligation to which the data controller is subject.
4. Vital interests: Processing is necessary to protect the vital interests of the individual or another person.
5. Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
6. Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests, rights, or freedoms of the individual.

These lawful bases provide a framework for organisations to ensure that they are processing personal data in a manner that is fair, transparent, and respects the rights of individuals under the UK GDPR.

We can advise you on choosing the correct lawful basis (or bases) for processing personal data – it is important to get it right from the outset as you are generally not allowed to change basis at a later date – there are some exceptions to this which we can advise on.