Businesses will only be able to process personal data collected if one (or more) of the following six grounds have been met.
Failure to comply with one or more of the grounds will result in a criminal offence.
Data controllers can obtain the consent of data subjects (ie the individuals to which the personal data relates) to process their personal data. Consent must be:
Consent can be given by way of a statement or affirmative action (ie it is no longer recommended that businesses rely on pre-ticked boxes).
Consent cannot be given by a child under the age of 16 unless there is parental consent (reasonable efforts must be taken to ensure that, where consent is provided by the parent, it is genuine).
The burden of proof lies with the data controller who must show that consent was validly obtained. As such, the data controller should regularly confirm, review and update consent.
For more information, read Consent for GDPR.
Performance of a contract
Processing is necessary for the performance of a contract or where it is necessary in order to ‘take steps’ at the request of the data subject before entering into the contract (eg providing a quote).
Compliance with a legal obligation
Where data is processed in order to comply with a legal obligation. The obligation does not have to be required by legislation or statute, but it must be clear having regard to the laws of the UK. For example, employers may be required to process certain health-related data to comply with their health and safety duties.
Vital interests of the data subject
Processing is required to protect the vital interests of the data subject or another individual.
Vital interests include interests essential for the life of the data subject or processing data for humanitarian purposes and, in particular, cases where a disaster has struck.
Processing is necessary for performing a task that is in the public interest or in the exercise of official authority vested in the data controller. For example, a local authority uses personal data to collect council tax.
Legitimate interests of the data controller
Legitimate interests can include commercial interests, individual interests or broader societal benefits. Processing is necessary for the legitimate interests pursued by the data controller or by a third party, as long as the processing does not override the fundamental rights and freedoms of the data subject (eg for network and information security or for the prevention of fraud).
Public authorities and any party dealing with children (as a child's interests will always override the interests of a data controller) are not able to rely on this ground.
Legitimate interests assessment
If a data controller wishes to rely on the legitimate interests ground, they must conduct a Legitimate interests assessment (LIA). An LIA is used to identify:
what that legitimate interest is
the benefits of processing the personal data in that way
is such processing is necessary
This means that the data controller must carry out a balancing exercise, in which they must demonstrate whether the legitimate interest being relied upon outweighs the data subject’s legitimate interests and rights.
For more information, read Legitimate interest assessments.
For more information on the lawful bases for processing, see the Information Commissioner's Office (ICO) guidance. If you need help determining your lawful basis for processing, you can use the ICO’s webtool.