Lawful basis

In order for personal data to be processed lawfully, it must be processed according to a specific lawful basis.  Personal data should only be processed if at least one of the following applies:

• The data subject has provided consent for the processing of the personal data for specific purposes
• The processing is necessary for the performance of a contract to which the data subject is party (or to take steps to move towards such a contract)
• The processing is necessary for compliance with a legal obligation, such as taxation regulations etc.
• The processing is required in order to protect the vital interests of the data subject, i.e. to sustain the life of the data subject
• The processing is necessary to perform a task in the public interest, most commonly used by council services or possibly by the media
• The processing is necessary for the purposes of the legitimate interest of the controller. 

Where the data being processed is sensitive personal data, then additional lawful bases are needed in order to justify the processing of this special category of data,