Legal bases for data processing

Understanding GDPR

Shalini Kurapati, CIPP/E

Co-founder and CEO, Clearbox AI

The six GDPR legal bases

  1. Consent
  2. Legitimate interest
  3. Legal obligation
  4. Contractual obligation
  5. Vital interests
  6. Public task
1 Article 6, GDPR
Understanding GDPR

Consent

Photo of a pen on top of a paper with an I agree checkbox.

  • Informed, unambiguous, and freely given
  • Clear and affirmative action
  • Real choice and control
  • Builds trust and engagement
  • Misconception - not the only legal basis
Understanding GDPR

Legitimate interest

Picture with 6 brown blocks on one side and one brown block on the other side of a balancing scale.

  • Flexible
  • Reasonable, lawful, and necessary purpose

  • Balance the interests of controller and data subjects

  • Examples

    • Direct marketing emails and ads
    • Charitable fundraising campaigns
    • Whistle-blowing schemes
1 Article 29 Working Party Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC
Understanding GDPR

Legal obligation

Illustration of a document with the words invoice, tax and paid, over which there is a rubber stamp held by a person's hand.

  • Fulfill legal requirement
  • Comply with EU or national laws

Example

  • Employee data
  • Social security/welfare
Understanding GDPR

Contractual obligation

Illustraction of a contract document. A hand holding a pen is shown as signing it on the bottom right of the document.

  • Fulfill a contract
  • Information needed for a contract

Example

  • Online shop
  • Customer information
  • Buyer-seller contract
Understanding GDPR

Vital interests

Illustration of a heart showing a ECG recording of heartbeats.

  • To protect someone's life

Example: Hospitals

  • Emergency medical care
  • Unplanned medical events - accidents
  • Patient unable to give consent
Understanding GDPR

Public task

Photo of a mural with illustrations of people from all walks of society walking.

  • Public interest
  • Exercise official authority

Examples

  • Scientific research projects
  • Activities that promote democracy
  • Public bodies - government functions
Understanding GDPR

Let's practice!

Understanding GDPR

Preparing Video For Download...