Lawful Processing of Personal Data
The principles
Processing must rest on a legal basis and follow core principles. Typical principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability (the organisation must be able to prove compliance).
Lawful bases
Common bases include consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. The trap is assuming consent is always required - it is only one basis. Equally, consent must be freely given, specific, informed and revocable; pre-ticked boxes or bundling consent into terms fail.
Minimisation and retention
Collect only what you need, keep it only as long as necessary, and document retention periods. Questions often present an organisation hoarding old data "just in case" - that breaches storage limitation and minimisation.
Transparency
Data subjects must be told what is collected, why, how long it is kept, and with whom it is shared, usually via a privacy notice.
Worked example
A gym wants to email members about a new class. It already has their email for membership administration. Relying on legitimate interests or a soft opt-in may be possible, but reusing the address for unrelated marketing without a valid basis is risky. The rule of thumb: for every processing activity, name the basis and the retention period - if you cannot, the processing is probably unlawful.