Processing and transferring data

Copyright © 2026 LexisNexis

This subtopic explains and provides practical guidance on the six potential lawful grounds for processing personal data under the United Kingdom General Data Protection Regulation (UK GDPR) (Assimilated Regulation (EU) 2016/679), also known as the legitimate grounds or conditions for processing. It also provides practical guidance on specific issues such as:

  1. •

    legitimate interest assessments

  2. •

    direct marketing

  3. •

    data processing in the employment relationship

  4. •

    supply chains under data protection law

  5. •

    data sharing between controllers

  6. •

    processing children’s personal data

Lawful grounds for processing personal data

There are six potentially lawful grounds for processing personal data:

  1. •

    the data subject has given consent to the processing of their personal data for one or more specific purposes

  2. •

    processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract

  3. •

    processing is necessary for compliance with a legal obligation to which you are subject

  4. •

    processing is necessary to protect the vital interests of the data subject or another natural person

  5. •

    processing

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

FCDO announces UK sanctions against Iranian authorities for human rights violations during peaceful protests

The Foreign, Commonwealth & Development Office (FCDO) has announced the UK’s package of sanctions against ten individuals and one organisation in Iran for enabling and facilitating recent human rights violations against peaceful protestors. These measures form part of the UK’s commitment to hold the Iranian authorities to account following widespread brutality and violence. The Law Enforcement Forces of the Islamic Republic of Iran (FARAJA) was sanctioned for its prominent role in policing protests in Iran and is subject to an immediate director disqualification and asset freeze, while the designated individuals—including the Minister of the Interior, several Police Chiefs, Islamic Revolutionary Guard Corps (IRGC) commanders, judges and an Iranian businessman—are subject to immediate asset freezes, travel bans and director disqualifications. The measures follow earlier commitments by the Prime Minister and the Foreign Secretary, recent human rights sanctions by the EU and US, and international condemnation by the G7 and EU High Representative, forming part of more than 550 existing UK sanctions against Iranian individuals and entities for human rights violations.

Key provisions of Data (Use and Access) Act 2025 to come into force on 5 February 2026

The Secretary of State has made the Data (Use and Access) Act 2025 (DUAA 2025) (Commencement No 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82, which bring the majority of the DUAA 2025’s data protection reforms into force from 5 February 2026. These regulations commence provisions relating to research and statistical purposes, consent to processing for scientific research, the lawfulness of processing, purpose limitation, data subject requests, automated decision-making, data protection by design for children, and the transfers of personal data to third countries, among others. Further provisions concerning complaints by data subjects will come into force on 19 June 2026.

ICO publishes letter on progress against economic growth commitments and work planned for 2026

The Information Commissioner’s Office (ICO) has published a letter to the Prime Minister, the Chancellor of the Exchequer, and the Secretary of State for Business and Trade setting out a one-year update on its five economic growth commitments made in January 2025. These commitments are to: (1) give businesses regulatory certainty on artificial intelligence (AI); (2) cut costs for small and medium-sized enterprises (SMEs); (3) enable greater innovation through its Regulatory Sandbox and Innovation Advice services; (4) unlock privacy-preserving online advertising; and (5) make it quicker and easier to transfer data internationally. The letter confirms that the ICO is working with the government on legislation to introduce a statutory code of practice on AI and automated decision-making, and that its expanded data essentials platform for SMEs is due to launch in spring 2026. It also states that the ICO has secured funding to design an experimentation regime to support the testing of emerging technologies, with research findings due by mid-February 2026. In addition, the ICO says it is assessing low-risk online advertising activities that could operate without consent under the Privacy and Electronic Communications Regulations (PECR) and will provide evidence to the government in the spring. The letter also highlights that the ICO published updated guidance on international data transfers in January 2026, aimed at simplifying requirements and supporting cross-border data flows, which underpin around 40% of UK exports. The ICO adds that it will continue to issue further guidance and improve regulatory clarity throughout 2026.

No timetable for Labour’s Equality (Race and Disability) Bill

Law360: The Minister for Equalities has declined to say when promised legislation to introduce ethnicity and disability pay gap reporting will be put forward.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a
Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Contributory negligence in personal injury claims

Contributory negligence in personal injury claims

Contributory negligence in personal injury claimsContributory negligence is a partial defence which can lead to a discount in damages.Other defences may also be relevant. See Practice Notes: Did the claimant consent to the risk of injury? and Was the claimant involved in an illegal activity?If a