Lawful Processing and Consent

Principle in Focus — Lawfulness

No processing without a reason that the law accepts.

Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.

Typical legal bases and valid consent

Consent of the data subject, e.g. for newsletters
Contract: data needed to deliver what the customer ordered or to employ someone
Legal obligation: e.g. tax, accounting and social security records
Vital interests: e.g. medical emergencies
Legitimate interests of the organisation, balanced against the rights of the person (not available in every law)

Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.

Legal basis in your jurisdiction

Mexico

Consent is the rule. It can be tacit for ordinary data, must be express for financial and property data, and express and in writing for sensitive data. A privacy notice (aviso de privacidad) must be available before data are collected.