The data controller can choose from six data processing bases. These are:
1. Contract- This
applies when you need to process the customer's personal data to
fulfill your contractual obligations, or to take some action based on
the customer's request (e.g. sending a quote or invoice).
2. Legal Obligation- This
applies when you have to comply with an obligation under any applicable
law (e.g. providing information in response to valid requests, such as
an investigation by an authority).
3. Vital Interests- This applies to urgent matters of life and death, especially with regards to health data.
4. Public Task- This applies to activities of public authorities.
5. Legitimate Interests- These can include commercial interests, such as direct marketing, individual interests, or broader societal benefits.
6. Consent- Consent
is also a lawful basis to process data. Consent of the data subject
means "any freely given, specific, informed, and unambiguous indication
of the data subject's wishes by which he or she, by a statement or a
clear affirmative action, signifies agreement to the processing of
personal data relating to him or her."
The
processing activities under these lawful bases should take place in
ways that people normally expect. The controller must document and keep a
record of decisions on legitimate interests in the form of a Legitimate Interests Assessment.