Lawful basis for processing data and the evidence required

The lawful basis for processing are set out in Article 6 of the GDPR. At least one of these must apply whenever you process personal data:

Consent 

The individual has given clear consent for you to process their personal data for a specific purpose.

Evidence required: Email address; date; time; URL; Full description of what they given their consent to.

Contract 

The processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

Evidence required: Provide proof that the email sent was required/requested by the contact.

Legal obligation 

The processing is necessary for you to comply with the law (not including contractual obligations).

Evidence required: Provide proof that the contact must receive the information by law.

Vital interests 

The processing is necessary to protect someone’s life.

Evidence required: Provide the relevant proof and evidence.

Public task 

The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

Evidence required: Provide the relevant proof and evidence.

Legitimate interests 

The processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.) 

Evidence required: You need to identify your precise purpose and show that it is legitimate in the specific circumstances. Example of legitimate interest:‘we have a legitimate interest in marketing our goods to existing customers to increase sales’. Provide the precise reasons why it is your legitimate interest to send to this contact AND how did you acquire it.