Principle in Focus — Lawfulness

No processing without a reason that the law accepts.

Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.

Typical legal bases and valid consent

  • Consent of the data subject, e.g. for newsletters
  • Contract: data needed to deliver what the customer ordered or to employ someone
  • Legal obligation: e.g. tax, accounting and social security records
  • Vital interests: e.g. medical emergencies
  • Legitimate interests of the organisation, balanced against the rights of the person (not available in every law)

Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.

Legal basis in your jurisdiction

Colombia

Prior, express and informed authorisation of the data subject is the rule, and the controller must be able to prove it. Exceptions include legal or judicial orders, medical emergencies, public data and historical, statistical or scientific purposes.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Colombia Slide 6 of 10