This Practice Note provides an introduction to reliance by financial services firms on legal obligation or legitimate interest as a lawful ground for processing personal data under the General Data Protection Regulation (EU) 2016/679 (EU GDPR). For general information on the EU GDPR, see Practice Note: The EU’s General Data Protection Regulation (EU GDPR). Lawful grounds for data processing under the GDPR—summary for financial services firms Definitions Personal data: any information relating to an identified or identifiable natural person (data subject)—an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording,