Data Protection Act
Lawful Reasons for Processing
Before an organisation can collect, store or use your personal data it needs a lawful reason to do so. Data protection law lists six of these, and an organisation should be able to name the one it is relying on.
The six lawful reasons
| Lawful reason | What it means | Example |
|---|---|---|
| Consent | The individual has clearly agreed to the processing. | A choir singer gives written permission for the choir to post a recording of the concert on its website. |
| Contract | Processing is needed to carry out a contract with the individual. | A repair shop gives your address to its courier so your fixed bike reaches you. |
| Legal obligation | Processing is needed to meet a legal requirement. | A nursery keeps a daily register of the children in its care, as the law requires. |
| Vital interests | Processing is necessary to safeguard a person whose life is at risk. | An outdoor activity centre passes a child's medical details to the hospital treating them after an accident on the course. |
| Public task | Processing is needed for an official public function. | A council logs which streets had a missed bin collection so it can run the service. |
| Legitimate interests | Processing is needed for a genuine interest of the organisation or another party, unless your rights override it. | A bank checks a card payment against fraud records before releasing the money. |
Apart from legitimate interests, each reason only works when the processing really is needed for that exact purpose, so an organisation cannot stretch one to cover something else. Legitimate interests is the widest, and it is the one that has to be balanced — it only works if the organisation's need does not unfairly override your rights and privacy.
Imagine you enter a fun run. The organiser needs your name and age to put you in the right race, and that is part of your contract with them. If it later wants your photo on next year's posters, the contract does not cover that, so it needs your consent instead — the same organisation can rely on different lawful reasons for different jobs.
Practise this
Edexcel GCSE Computer Science · Data Protection Act