³ÉÈËÓ°Òô

Processing and transfer of data


This subtopic explains and provides practical guidance on the six potential lawful grounds for processing personal data under the United Kingdom General Data Protection Regulation (UK GDPR) (Assimilated Regulation (EU) 2016/679), also known as the legitimate grounds or conditions for processing. It also provides practical guidance on specific issues such as:

  1. •

    legitimate interest assessments

  2. •

    direct marketing

  3. •

    data processing in the employment relationship

  4. •

    supply chains under data protection law

  5. •

    data sharing between controllers

  6. •

    processing children’s personal data

Lawful grounds for processing personal data

There are six potentially lawful grounds for processing personal data:

  1. •

    the data subject has given consent to the processing of their personal data for one or more specific purposes

  2. •

    processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract

  3. •

    processing is necessary for compliance with a legal obligation to which you are subject

  4. •

    processing is necessary to protect the vital interests of the data subject or another natural person

  5. •

    processing

To view the latest version of this document and thousands of others like it, sign-in with ³ÉÈËÓ°Òô or register for a free trial.

TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

House of Lords conclude committee stage of Data (Use and Access) Bill

The House of Lords has completed the committee stage of the Data (Use and Access) Bill, the final day of scrutiny took place on 18 December 2024 and focused on amendments related to children and AI, national security and data privacy risks and AI compliance with UK copyright law. The bill, aimed at harnessing data for economic growth and improving digital governance, has undergone thorough examination over multiple sessions, addressing issues such as protection of children, misuse of AI rules, data mining and processing of personal data. The next stage, report stage, is scheduled for 21 January 2025.

Businesses should expect a role in tackling fraud next year

Law360, London: If one word sums up a key trend in financial crime enforcement in 2024, it would be fraud, specifically consumer fraud.

FCDO imposes sanctions on Georgian officials for human rights violations

The Foreign, Commonwealth and Development Office (FCDO) has announced sanctions against five senior Georgian officials in response to violent attacks on journalists and peaceful protestors. This action, coordinated with the United States, imposes UK travel bans and asset freezes on the individuals responsible for the crackdown following public opposition to the Georgian Dream party's decision to pause the country's European integration. The sanctions follow the UK's recent suspension of programme support to the Georgian government and restriction of defence cooperation. The FCDO's decision aligns with condemnations from UN experts and the OSCE regarding the pattern of repression and human rights violations in Georgia, particularly in light of the use of force against protestors after the October parliamentary elections.

SARs in Action Issue 29 published

The UK Financial Intelligence Unit’s (UKFIU) magazine, SARs in Action, has published its 29th issue focusing on recent developments in economic crime prevention. The publication emphasises the financial sector's crucial role in detecting and disrupting human trafficking, which affects an estimated 49.6 million people globally. It introduces the Illicit Finance Public Private Threat Group (PPTG) Hydroponics Cell and its recent Amber Alert. The magazine also covers the 2024 Global Financial Institutions Partnership Summit in Ottawa and announces the winners of the 2024 Tackling Economic Crime Awards. Additionally, it highlights Companies House's analysis of company formations used for money laundering and introduces a new Trafficking in Human Beings Handbook, underscoring the importance of the regulated financial industry in combating this pervasive criminal enterprise.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

UK GDPR—the basics

UK GDPR—the basicsThis Practice Note explains, in simple terms, the key features of the UK General Data Protection Regulation (UK GDPR). See also Precedent: Data protection quick reference guide.This Practice Note is intended for non-privacy specialists and there are separate, more detailed,

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection officer (DPO) with the Information Commissioner’s Office (ICO), does it need to register a DPO in the other EU states where it has entities or is registration in one country sufficient?Under Article 37

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staffThis Precedent presentation has been designed as an aid to train your staff on the general principles of data protection and how to manage this in the workplace. This Precedent is of general application, but incorporates the

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may not
UK GDPR—the basics

UK GDPR—the basics

UK GDPR—the basicsThis Practice Note explains, in simple terms, the key features of the UK General Data Protection Regulation (UK GDPR). See also Precedent: Data protection quick reference guide.This Practice Note is intended for non-privacy specialists and there are separate, more detailed,

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection officer (DPO) with the Information Commissioner’s Office (ICO), does it need to register a DPO in the other EU states where it has entities or is registration in one country sufficient?Under Article 37

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staffThis Precedent presentation has been designed as an aid to train your staff on the general principles of data protection and how to manage this in the workplace. This Precedent is of general application, but incorporates the

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may not