Lawful basis for processing—decision tree


Published by a ÀÏ˾»úÎçÒ¹¸£Àû Risk & Compliance expert
Precedents

Lawful basis for processing—decision tree


Published by a ÀÏ˾»úÎçÒ¹¸£Àû Risk & Compliance expert

Precedents
imgtext

We cannot process personal data simply because we wish to do so. We can only process personal data if we satisfy one of the conditions set out in Article 6(1) of the UK General data protection Regulation (UK GDPR). These are commonly known as the lawful grounds, legitimate grounds or conditions for processing.

This decision tree poses a series of questions to determine whether a proposed processing activity has a lawful basis data under the UK GDPR. If in doubt, please contact [insert name].

Note 1—contractual performance

We may process personal data where necessary:

  1. •

    for the performance of a contract to which the data subject is party, or

  2. •

    to take steps

Powered by Lexis+®
Jurisdiction(s):
United Kingdom
Key definition:
Personal data definition
What does Personal data mean?

Personal data means data relating to a living individual who can be identified from such data, either alone or with other information in the data controller’s possession. It includes opinions about, and intentions in relation to the data subject.

Read more readmore

Popular documents

UK GDPR—the basics

UK GDPR—the basicsThis Practice Note explains, in simple terms, the key features of the UK General Data Protection Regulation (UK GDPR). See also Precedent: Data protection quick reference guide.This Practice Note is intended for non-privacy specialists and there are separate, more detailed,

Public statement on data breach

Public statement on data breachStatement by [insert name of organisation] concerning a significant [cyber-attack OR data protection breach] on [insert date].On [date], we were made aware of an incident threatening the security of personal data for which we are responsible. [We OR [insert name of

How do I calculate the time limit for responding to a data subject request?

How do I calculate the time limit for responding to a data subject request?The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile1DPO detailsName of organisation[Insert name of organisation]Name of DPO[Insert name]Reports to[Insert name and/or position]Full time/part time[Insert]Details of any other roles held within the organisation[Insert details of any other roles