STOP! You need to have a lawful basis for processing personal data belonging to others
A controller may process personal data on one (or more) of the following legal grounds:
- Consent
- For the performance of a contract
- For compliance with a legal obligation imposed on a controller
- To protect vital interests
- For tasks performed in the public interest
- For the legitimate interests of a controller or a third party
Many organisations will not have thought about their lawful basis for processing personal data. The GDPR makes the legal basis more relevant because some individuals’ rights will be modified depending on your lawful basis for processing their personal data. The most obvious example is that people will have a stronger right to have their data deleted where consent is the lawful basis for processing.
You will also have to explain your lawful basis for processing personal data in your privacy notice and when you answer a data subject access request. The lawful basis in the GDPR are broadly the same as the conditions for processing in the Data Protection Acts.
Whatever you need, Privacy Consultants have you covered.
Contact us for a fixed price that suits you.