Task 3 — Purposes & Legal Basis

"Business purposes" is not a purpose. Be specific — and name the legal basis.

Every processing activity needs a specific purpose and a legal basis that the applicable law accepts. The purpose also limits what you may do with the data later.

How to do it

Describe the purpose specifically: "pay salaries and report to tax authorities", not "HR administration"
Assign the legal basis the applicable law offers, e.g. contract, legal obligation, legitimate interest or consent
Legitimate interest: document the balancing of your interest against the rights of the person
No new purposes that are incompatible with the original one — e.g. using applicant data for marketing

Legal basis in your jurisdiction

Colombia

Prior, express and informed authorisation of the data subject is the rule, and the controller must be able to prove it. Exceptions include legal or judicial orders, medical emergencies, public data and historical, statistical or scientific purposes.

Example: purposes and legal bases

Processing activity	Specific purpose	Typical legal basis
Payroll	Pay salaries, report to tax and social security authorities	Contract and legal obligation
Recruitment	Select applicants for an open position	Steps before entering into a contract
Newsletter	Send product news to subscribers	Consent
Video surveillance	Protect the warehouse against theft	Legitimate interest, with documented balancing