Data Protection Principles and Lawful Bases for Processing
What to know
Master the core principles: lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. For each processing activity, identify a lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests) and, where sensitive data is involved, a separate special-category condition. Understand compatibility analysis for secondary use, pseudonymisation versus anonymisation, and privacy by design and by default.
Traps
- Choosing a basis that does not fit the facts: consent where there is a power imbalance (employment), or contract for processing that is not objectively necessary to perform it.
- Confusing consent (revocable, specific) with contract (not revocable at will).
- Treating pseudonymised data as anonymous; it remains personal data.
- Forgetting that special-category processing needs both an Article 6 basis and a separate condition.
- Assuming legitimate interests is unavailable to public authorities for their public tasks.
Worked example
A retailer wants to email past customers about similar products. Rule of thumb: soft opt-in may apply where the customer bought similar goods, was given an opt-out at collection, and can opt out in every message. If those conditions fail, obtain freely given, specific, informed, unambiguous consent with a clear affirmative action. Pre-ticked boxes and silence are not consent.
Rule of thumb
For every activity, write: purpose, data categories, basis, retention, recipients. If you cannot state the basis in one sentence, the processing is not ready.