Article 6 — Legal Bases for Processing General Personal Data

Legal Provision

Legal bases for processing general personal data: define the conditions under which an entity is enabled or authorized to process such data.

Scope

Applies to the entities determining the purposes and means of the processing: data controllers.

Requirement type

Duty: when processing personal data, the entity must establish a valid legal basis.

Or

Permission: when an entity has a legal basis, it is ‘authorised’ to process that personal data.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Consent: a signed consent form is stored, or consent is clearly recorded (e.g., by clicking Accept Terms and Conditions)
• Contractual necessity: record or copy of the contract or service agreement under which the data processing is required.
• Legal obligation: available privacy notice or policy that references the specific law or regulation enabling the data processing.
• Vital interest: documentation or other evidence of the urgent situation (e.g. emergency, danger to life)
• Public task or authority: available privacy notice or policy that references the specific law granting the entity or organization authority to process personal data.
• Legitimate interest: record of a Legitimate Interest Assessment (LIA).

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required to further verify compliance with each specific legal basis.

• Consent: verification that consent is freely given, specific, informed, unambiguous and easy to withdraw.
• Contractual necessity: verification that the data requested is directly tied to the effectiveness and performance of the contract.
• Legal obligation: verification that the law enabling the data processing is specific and applies to your organization. In addition, the data must be necessary, rather than merely useful, for fulfilling the legal duty.
• Vital interests: documentation must demonstrate why the situation was urgent and why it was not possible to obtain consent in time (or why another legal basis did not apply).
• Public interest: verification that the specific law enabling the data processing effectively grants your organization public authority to process personal data.
• Legitimate interest: the LIA must demonstrate that your interest is valid, the data requested are necessary, and any risk to the individual is minimal and justified.

Monitoring requirement

• Verification of stored documentation confirming the applicability and validity of the legal basis.
• Among others:
  • a. Verification that consent has not been withdrawn or that the contract remains in force.
  • b. Enabling laws remain in force and are applicable.
  • c. Reassess legitimate interest balance to ensure they still outweigh any impact on individuals or the existence of vital interest.

Consequences of non-compliance

• Fines up to €20 million or 4% of global turnover.
• Legal claims for damages by individuals.
• Suspension or deletion of data processing
• Reputational damage and loss of public trust.
• Supervisory authorities can conduct investigative, corrective and advisory powers.