Lawful processing

Lawful basis for processing personal data

In order to process personal data you must have a lawful basis to do so. The lawful grounds for processing personal data are set out in Article 6 of the GDPR. These are:

  • The consent of the individual;
  • Performance of a contract;
  • Compliance with a legal obligation;
  • Necessary to protect the vital interests of a person;
  • Necessary for the performance of a task carried out in the public interest; or
  • In the legitimate interests of company/organisation (except where those interests are overridden by the interests or rights and freedoms of the data subject).