Legal Bases for Processing Training

What the training consists of

1. 

   1. Introduction to legal bases

   1:04

   The first lesson explains that every use of personal data at work needs a legal basis under the GDPR. It links this to the principles of lawfulness and purpose limitation (using data in line with the purpose it was collected for).

2. 

   2. The six legal bases of the GDPR

   1:37

   The second lesson goes through the six legal bases in the GDPR, each with an example: consent, contract, legal obligation, legitimate interest, public task (processing in the public interest or under official authority) and vital interests.

3. 

   3. Sensitive personal data and your legal basis

   1:20

   Sensitive personal data, such as health information or trade union membership, may only be processed under strict conditions. The third lesson sets out those conditions and the national rules for data on criminal convictions.

4. 

   4. Legal bases in different teams

   0:58

   The last lesson applies the legal bases to three situations: a marketing campaign collecting customer data, HR handling employee data and IT introducing new software. For each, it names bases that may apply, such as consent or legitimate interest.

Why it matters

Using personal data without the right legal basis could increase the privacy risk for the people it is about and lead to a fine. Keeping each activity within its legal basis is the organisation’s responsibility.

What your colleagues learn

• A new project needs its own legal basis. Before an idea that uses personal data goes ahead, the organisation needs a legal basis for that specific use, which should be recorded in its compliance documentation.
• Consent is only one of the six legal bases. A newsletter needs each subscriber’s clear, explicit consent, but processing an online order is a contractual necessity: the address and payment details are needed to complete it.
• Legitimate interest has to be weighed against people’s privacy. A company’s interest in protecting its premises could justify processing CCTV footage of people, but that interest has to be balanced with the privacy rights of everyone filmed.
• Sick leave brings sensitive data into HR. An employee’s medical leave means handling health information, so the strict conditions for sensitive data apply in an ordinary office, not only in healthcare.
• Each task with personal data starts with one question. Asking “what is the legal basis for this?” before collecting or using personal data helps colleagues handle it lawfully, without needing to be legal experts.