Processing personal data—lawful processing
Processing personal data—lawful processing

The following Risk & Compliance guidance note provides comprehensive and up to date legal information covering:

  • Processing personal data—lawful processing
  • The lawful grounds for processing personal data under GDPR
  • Processing must be necessary
  • Consent
  • Performance of a contract
  • Compliance with a legal obligation
  • Vital interests of the data subject or of another natural person
  • For the performance of a task carried out in the public interest or in the exercise of official authority vested
  • Legitimate interests
  • Grounds required for special categories of personal data
  • more

Brexit: As of exit day (31 January 2020), the UK is no longer an EU Member State, but it has entered an implementation period during which it continues to be treated by the EU as a Member State for many purposes. The UK must continue to adhere to its obligations under EU law, including in relation to data protection, and the ICO has confirmed the GDPR will continue to apply during the implementation period. For more information, see: Practice Note: Brexit—implications for data protection.

An organisation cannot simply process personal data because it wishes to do so. It can only process personal data if it satisfies one of the conditions set out in Article 6(1) of Regulation 2016/679, General Data Protection Regulation. These are commonly known as the ‘lawful grounds’, ‘legitimate grounds’ or ‘conditions’ for processing.

If your organisation processes personal data in the absence of a lawful ground, it will breach the GDPR. Failing to comply with the GDPR can expose an organisation to serious reputational damage, claims by aggrieved data subjects and fines up to €20m or up to 4% of the total worldwide annual turnover.

The lawful grounds for processing personal data under GDPR

Under the GDPR, there are six potentially lawful grounds for processing personal data:

  1. the data subject has given consent to the processing of their personal