Task 3 — Purposes & Legal Basis

"Business purposes" is not a purpose. Be specific — and name the legal basis.

Every processing activity needs a specific purpose and a legal basis that the applicable law accepts. The purpose also limits what you may do with the data later.

How to do it

Describe the purpose specifically: "pay salaries and report to tax authorities", not "HR administration"
Assign the legal basis the applicable law offers, e.g. contract, legal obligation, legitimate interest or consent
Legitimate interest: document the balancing of your interest against the rights of the person
No new purposes that are incompatible with the original one — e.g. using applicant data for marketing

Legal basis in your jurisdiction

Malta

Six legal bases (Art. 6 GDPR): consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. Consent is only one of them and is often not the best choice, e.g. in employment relationships.

Example: purposes and legal bases

Processing activity	Specific purpose	Typical legal basis
Payroll	Pay salaries, report to tax and social security authorities	Contract and legal obligation
Recruitment	Select applicants for an open position	Steps before entering into a contract
Newsletter	Send product news to subscribers	Consent
Video surveillance	Protect the warehouse against theft	Legitimate interest, with documented balancing