Lawful Processing and Consent

Principle in Focus — Lawfulness

No processing without a reason that the law accepts.

Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.

Typical legal bases and valid consent

Consent of the data subject, e.g. for newsletters
Contract: data needed to deliver what the customer ordered or to employ someone
Legal obligation: e.g. tax, accounting and social security records
Vital interests: e.g. medical emergencies
Legitimate interests of the organisation, balanced against the rights of the person (not available in every law)

Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.

Legal basis in your jurisdiction

Germany

Six legal bases (Art. 6 GDPR): consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. Consent is only one of them and is often not the best choice, e.g. in employment relationships.