Skip to Primary Navigation

EU GDPR Art 6

Sets out the lawful bases on which personal data can be processed. The lawful basis must be determined and documented before processing of the personal data begins.

Rule Overview

Jurisdiction: European Union

Regulator: ESMA

Topic: Data Protection

Overview
Rules in This Collection
Notable
Latest News
Further Reading

Processing of personal data is lawful for the following reasons only:

  • subject has given consent;
  • contractual necessity;
  • legal necessity;
  • protection of a person’s vital interests;
  • public interest; and
  • legitimate interest except where overridden by fundamental rights.

The last point does not apply to public authorities performing their tasks.

Where processing is not based on consent or legal sanction the controller needs to take into account:

  • link(s) between original collection purpose and intended further processing purpose(s);
  • context of original collection (relationship between subject and controller);
  • nature of the data;
  • possible consequences of intended further processing; and
  • existence of appropriate safeguards.
Rules in This Collection
Notable

Latest News

View More News