Principle in Focus — Lawfulness

No processing without a reason that the law accepts.

Lawfulness means that every processing activity needs a legal basis or a justification. Laws differ most in this point: some are built on consent, others offer several equal legal bases.

Typical legal bases and valid consent

  • Consent of the data subject, e.g. for newsletters
  • Contract: data needed to deliver what the customer ordered or to employ someone
  • Legal obligation: e.g. tax, accounting and social security records
  • Vital interests: e.g. medical emergencies
  • Legitimate interests of the organisation, balanced against the rights of the person (not available in every law)

Valid consent is freely given, specific, informed and unambiguous — and it can be withdrawn at any time. Pre-ticked boxes and consent hidden in terms and conditions do not count.

Legal basis in your jurisdiction

Malaysia

Consent is the rule under the General Principle, and explicit consent is needed for sensitive data. Exceptions include performance of a contract, legal obligations and the vital interests of the data subject.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Malaysia Slide 6 of 10