Rules Navigator

EU GDPR Art 6

Sets out the lawful bases on which personal data can be processed. The lawful basis must be determined and documented before processing of the personal data begins.

Rule Overview

Jurisdiction: European Union

Regulator: ESMA

Topic: Data Protection

Overview
Rules in This Collection
Notable
Latest News
Further Reading

Processing of personal data is lawful for the following reasons only:

  • subject has given consent;
  • contractual necessity;
  • legal necessity;
  • protection of a person’s vital interests;
  • public interest; and
  • legitimate interest except where overridden by fundamental rights.

The last point does not apply to public authorities performing their tasks.

Where processing is not based on consent or legal sanction the controller needs to take into account:

  • link(s) between original collection purpose and intended further processing purpose(s);
  • context of original collection (relationship between subject and controller);
  • nature of the data;
  • possible consequences of intended further processing; and
  • existence of appropriate safeguards.
Rules in This Collection
EU GDPR
EU GDPR Art 6 This Rule
Notable
CJEU makes landmark decision in Meta vs Bundeskartellamt

CJEU makes landmark decision in Meta vs Bundeskartellamt

Judgment allows GDPR scrutiny through antitrust regulators and imposes limitations on personalized use of consumers’ personal data.

Verena Grentzenberg | DLA Piper, Philipp Schmechel | DLA Piper, Dr. Jonas Kranz | DLA Piper12 min read

Norwegian Data Protection Authority wins against Meta in court

Norwegian Data Protection Authority wins against Meta in court

The Norwegian authority has put a temporary ban on the social media giant after its illegal behaviour-based marketing.

Martina Lindberg1 min read

Using data protection to counter bias in generative AI

Using data protection to counter bias in generative AI

Practical steps to mitigate against bias and hallucinations when using and developing AI models.

Kirsten Ammon | Fieldfisher5 min read

Privacy

CJEU makes landmark decision in Meta vs Bundeskartellamt

Privacy

Norwegian Data Protection Authority wins against Meta in court

AI

Using data protection to counter bias in generative AI

Latest News More on EU GDPR 

Further Reading

ICO guide to lawful basis Go to https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/