Legal bases and data subject rights
Article 7: ten bases, no hierarchy
Processing is lawful only if it fits one of: (1) consent; (2) compliance with a legal or regulatory obligation by the controller; (3) public administration executing public policies; (4) research by a research body, anonymised where possible; (5) contract performance or pre-contractual steps at the subject's request; (6) exercise of rights in judicial, administrative or arbitration proceedings; (7) protection of life or physical safety of the subject or a third party; (8) health protection by health professionals, services or authorities; (9) legitimate interest; (10) credit protection. Consent is neither mandatory nor superior - a payroll file rests on legal obligation.
Article 11: sensitive data has fewer doors
Consent must be specific and highlighted; the alternatives are legal obligation, public policy, research (anonymised where possible), exercise of rights, life or physical safety, health protection, and fraud prevention in identification and authentication. Legitimate interest and contract are unavailable.
Consent, done properly (Arts. 8–9)
Free, informed, unambiguous and purpose-specific; written consent must highlight the purpose; the controller bears the burden of proof; consent is void if the information was misleading; it is revocable at any time, and revocation does not taint processing already done.
Rights (Arts. 18–20)
Confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary, excessive or unlawful data; portability (regulated by ANPD); deletion of consented data, subject to Article 16 retention exceptions; information about sharing; information about the consequences of refusing consent; revocation. Requests are answered within 15 days (Art. 19). Article 20 adds review of decisions taken solely by automated means that affect the subject's interests, with clear information on criteria, subject to trade secrecy.
Worked example
A gym wants fingerprint access control. Biometric data is sensitive, so a generic newsletter consent is insufficient: the clause must be specific, highlighted, and explain that access depends on it. If the gym later reused those templates to bill a partner insurer, that is a new purpose needing a separate basis; Article 11 has no legitimate-interest fallback.
Traps
- Reaching for legitimate interest on health, biometric or other sensitive data.
- Treating consent as a one-off, irrevocable licence.
- Confusing the 15-day response deadline with breach notification.
- Assuming portability is self-executing: it is exercised under ANPD rules.
- Forgetting Article 16: deletion is the rule at end of purpose, retention the exception.