Process personal data lawfully

Data controllers need to rely on a “legal basis” in order to process personal data lawfully. It is essential to identify the appropriate legal basis as it may come with specific requirements (e.g. consent must be free, specific, informed and unambiguous) and have consequences on individuals’ rights (e.g. the right to portability only applies when the legal basis is consent or a contract).

On this page, you will find more information on the different legal bases under the GDPR. Find out more about the rights that apply per legal basis.

Data controllers can only process personal data in one of the following circumstances:

• with the consent of the individuals concerned;
• where there is a contractual obligation (a contract between your organisation and an individual);
• to meet a legal obligation under EU or national legislation;
• where processing is necessary for the performance of a task carried out in the public interest under EU or national legislation;
• to protect the vital interests of an individual;
• for your organisation’s legitimate interests (except if these are overridden by the interests or fundamental rights of individuals) .

In addition, the GDPR establishes additional conditions for the processing of sensitive data.

Conditions for consent

Free

Consent is freely given when individuals are able to refuse and withdraw their consent with no risk of external pressure or negative consequences. Individuals must also have the right to withdraw their consent at any time; this process must be made easy for individuals to do (as easily as it was to provide it). Withdrawing consent must not affect the processing of the individual’s personal data that was done prior to this withdrawal, when consent was still valid.

For example, in principle, employees will not be in a position to freely provide consent to processing carried out by their employer, as employees may feel that they are unable to refuse their employer’s request.

Specific

For consent to be valid, it must also be specific to the processing purpose. This condition is closely related to the condition of informed consent: individuals must be informed of the specific purposes in a plain and easy to understand language, so that they have a clear idea for which purposes their data is being processed. This also means that if the purposes of the processing operation change or if additional processing operations are added, individuals should be asked for their consent again. Likewise, if a processing operation has multiple purposes, consent should be given for each of them.

For example, a streaming service collects their clients’ personal data to offer them tailored viewing suggestions. After some time, the streaming service decides to share their clients’ personal data with third parties so that they can send targeted advertising to the clients based on their viewing habits. As this is a new purpose, the streaming service will have to ask for their client’s consent.

Informed

When requesting consent from an individual, your organisation must ensure that this request is communicated to the individual in an intelligible and easily accessible form, using clear and plain language. Information should be given about the purposes, the identity of the controller, the categories of data, the recipients and the right to withdraw consent.

Unambiguous

For consent to be unambiguous, there should be a clear affirmative action (without pre-ticked boxes and made separately from applicable general conditions).

It is recommended to refresh the consent at appropriate intervals. In addition, you must be able to demonstrate that the individual whose data is processed has given their consent, for example through a written or signed declaration, or by a deliberate action like ticking a box.

Conditions applicable to children’s consent

As a data controller, you should take reasonable efforts to check the age of the individual.

Children aged 16 and above are considered as being able to give their own consent.

For children below the age of 16, your organisation must request consent from that child’s legal guardian or parent. In this case, you would have to take reasonable efforts to check that the person consenting on behalf of the child has the parental responsibility. Please note, however, that the GDPR gives EU Countries the possibility to, through national law, set the age of consent between 13 and 16, when services are provided via internet. Therefore, it is advised to check your national provisions on this matter.

When consent can be provided by children, the language used to communicate the information relating to the service should be adapted to their age.

Processing the personal data of an individual for the performance of a contract is a valid legal basis, for example, in the following cases:

• Your organisation needs to process an individual’s personal data to provide a service.
• A potential client or customer has asked you to do something before entering into a contract with your organisation, for example they may wish to receive a quote for the services that you provide, for which you may need to process some of their personal data.

The processing must be necessary for the performance of a contract. In practice, this means that your organisation cannot proceed with the execution of the contract or service without the personal data in question. It is recommended that your organisation documents the reasons explaining why the processing of an individual’s data is necessary for the performance of a contract.

This legal basis does not apply, however, if you wish to process an individual’s personal data for marketing purposes, fraud prevention, targeted advertising or any other purposes related to your organisation’s business model. In such cases, other legal bases may be available, such as consent or legitimate interest, provided that the relevant criteria are met.

Legislations may also impose the processing of personal data, even after the termination of the contract (for instance, to keep records for accounting purposes).

Naturally, the contract must also be valid under the applicable law.

The GDPR provides for another legal basis, namely: it is necessary for compliance with a legal obligation to which the data controller is subject.

This legal basis can be relied on where a processing operation is imposed on an organisation by EU or national legislation. More specifically, four conditions must be met:

• the legal obligation must be defined by EU or national law to which the controller is subject;
• these legal provisions must establish a clear and specific obligation to process that personal data;
• these provisions must at least define the purposes of the processing;
• this obligation should be imposed on the controller and not on the data subjects. 

If these conditions are not met, the processing operation cannot be based on the legal obligation and another legal basis must be sought.

The GDPR provides for many different circumstances in which data controllers are legally obliged to process their customers’ or clients’ personal data. For example, employers usually need to process their employees’ personal data for social security purposes, or a business often needs to process their clients’ or customers’ personal data for tax purposes.

Processing data to protect the vital interests of an individual can be relied on only in rare and specific cases. This may be the case, for instance, if you need to process personal data to protect someone’s life. However, based on the GDPR, this legal basis is very limited in scope and can only be relied on in the case of emergencies.

In some specific cases, your organisation may be able to process individuals’ personal data for a task carried out in the public interest. In this case, the processing must have a basis in EU or national law. Its purpose must be determined in that legal basis or be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. Therefore, this legal basis may be relevant, in particular, for processing operations by public authorities for the purpose of carrying out their tasks.

Your organisation may be able to process individuals’ data for matters of legitimate interests, provided that these interests (commercial, protecting your property, etc.) do not create an imbalance to the detriment of the rights and interests of individuals.

While the GDPR and relevant case law of the Court of Justice of the European Union (CJEU) provide for examples of legitimate interests, there is no exhaustive list.

However, you must ensure that this interest respects a certain number of requirements:

• it must be lawful, clear, real and present;
• the processing must be a necessary for pursuing this interest;
• the legitimate interest must take into account the individual’s rights to data protection, which cannot be overridden. In the context of this requirement, the controller must weigh its legitimate interest and the interests or fundamental rights and freedoms of individuals and must also consider what they may reasonably expect. This balancing exercise must be made in light of the concrete conditions under which these operations are carried out.

• The individual has given their explicit consent for their sensitive data to be processed.
• The processing of sensitive data is necessary for the data controller to fulfil their obligations, specifically in the context of employment, social security and social protection. For example, the data controller may need to process a person’s sensitive data to be able to determine if they are entitled to certain social security benefits or employment stipends.
• The processing of sensitive data is necessary to protect the vital interests of a person where the individual is physically or legally incapable of giving consent. For example, if an individual is left unconscious as a result of an accident and requires immediate medical care, their special categories of personal data may need to be processed for the appropriate medical care to be delivered.
• The processing of sensitive data is carried out in the context of the legitimate activities of a foundation, association or other non-for-profit organisation with a political, philosophical, religious or trade union aim, and only for the processing of the personal data of their members, former members or persons having regular contact with them.
• The sensitive data was manifestly made public by individuals.
• The processing of sensitive data is necessary in the context of legal proceedings.
• The processing of sensitive data is necessary for matters of substantial public interest.
• The processing of sensitive data is necessary in the context of preventive or occupational medicine. For example, assessing an individual’s sensitive data, such as their medical data, may be necessary to determine their working capacity as an employee.
• The processing of sensitive data is necessary for matters of public health on the basis of EU or national law. For example, processing individuals’ sensitive data may be necessary to ensure a high quality of health care and a high quality of medical products, or to combat serious health threats, such as viruses.
• The processing of sensitive data is necessary for matters of archiving purposes in the public interest, or for scientific, statistical, historical, or research purposes. For example, processing sensitive data may be necessary to provide accurate statistics on a country’s situation in a particular field.