Processing and transfer data

Copyright © 2025 LexisNexis

This subtopic explains and provides practical guidance on the six potential lawful grounds for processing personal data under the United Kingdom General Data Protection Regulation (UK GDPR) (Assimilated Regulation (EU) 2016/679), also known as the legitimate grounds or conditions for processing. It also provides practical guidance on specific issues such as:

  1. •

    legitimate interest assessments

  2. •

    direct marketing

  3. •

    data processing in the employment relationship

  4. •

    supply chains under data protection law

  5. •

    data sharing between controllers

  6. •

    processing children’s personal data

Lawful grounds for processing personal data

There are six potentially lawful grounds for processing personal data:

  1. •

    the data subject has given consent to the processing of their personal data for one or more specific purposes

  2. •

    processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract

  3. •

    processing is necessary for compliance with a legal obligation to which you are subject

  4. •

    processing is necessary to protect the vital interests of the data subject or another natural person

  5. •

    processing

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Practice Compliance News

ICO clarifies myths on storage and access technologies

The Information Commissioner’s Office (ICO) has clarified common misconceptions about how the Privacy and Electronic Communications Regulations (PECR) apply to storage and access technologies such as cookies, tracking pixels and device fingerprinting. It confirmed that PECR is not limited to personal data, that ‘strictly necessary’ must be judged from the user’s perspective, and that consent is required for non-exempt purposes. The ICO also noted that a draft impact assessment has been published and will be finalised following consultation.

OFSI publishes annual frozen assets reporting notice for 2025

The Office of Financial Sanctions Implementation (OFSI) has published its annual frozen assets reporting notice for 2025. The notice outlines the annual reporting obligations under UK financial sanctions legislation. All individuals and entities holding or controlling funds or economic resources belonging to designated persons must provide the required report to OFSI by 30 November 2025. This includes assets both within the UK and overseas, provided they fall under UK jurisdiction. Reports must reflect the status of these assets as of 30 September 2025.

Practice Compliance weekly highlights—11 September 2025

This week's edition of Practice Compliance weekly highlights includes OFSI’s first counter-terrorism sanctions breach notice, the final version of updated encryption guidance from the ICO, the commencement of certain Data (Use and Access) Act provisions and an update to the SRA’s guidance on equality, diversity and inclusion obligations.

Balancing Data Protection and Online Safety—the ICO’s new guidance on profiling tools

Information Law analysis: Jose Saras, partner, and Xavier Prida, associate, of Preiskel LLP, consider the new ICO guidance on profiling tools for online safety and its articulation with Assimilated Regulation (EU) 2016/679 (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR 2003).

View Practice Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of
Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of