Q&As

Which of the General Data Protection Regulation (GDPR) lawful grounds might be appropriate for processing the personal data of entrants to a prize competition? Does the answer differ if the data may subsequently be used for direct marketing purposes?

read titleRead full title
Produced in partnership with Helen Hart of Institute of Promotional Marketing
Published on LexisPSL on 19/08/2019

The following TMT Q&A produced in partnership with Helen Hart of Institute of Promotional Marketing provides comprehensive and up to date legal information covering:

  • Which of the General Data Protection Regulation (GDPR) lawful grounds might be appropriate for processing the personal data of entrants to a prize competition? Does the answer differ if the data may subsequently be used for direct marketing purposes?
  • Performance of a contract
  • Legitimate interests
  • Consent
  • Direct marketing

Which of the General Data Protection Regulation (GDPR) lawful grounds might be appropriate for processing the personal data of entrants to a prize competition? Does the answer differ if the data may subsequently be used for direct marketing purposes?

This Q&A assumes that the prize competition is a sales promotion for consumers, rather than a trade promotion or other type of competition. A controller can only lawfully process personal data in compliance with the lawfulness, fairness and transparency principle under Article 5(1)(a) of Regulation (EU) 2016/679, the General Data Protection Regulation (the GDPR) if it satisfies one of the six conditions set out in Article 6(1) of the GDPR. See Practice Notes: Data protection principles and Lawful basis for personal data processing.

The three conditions relevant to prize promotions are:

  1. processing is necessary for the performance of a contract to which the data subject is a party

  2. processing is necessary for the purpose of the legitimate interests pursued by the controller or a third party

  3. the data subject has given consent to the processing of their personal data for one or more specific purposes (see Practice Notes: Processing personal data—standard of consent and Processing personal data—obtaining, recording and managing consent)

For more information on the GDPR, see Practice Note: Introduction to the EU GDPR and UK GDPR.

Performance of a contract

This condition covers processing that is necessary for

Popular documents