Processing and transferring data

STOP PRESS: This document is being updated to reflect implementation of the Data (Use and Access) Act 2025 (DUAA 2025) which amends the UK GDPR and Data Protection Act 2018. For more guidance on the compliance implications of DUAA 2025, see Practice Note: Data (Use and Access) Act 2025—compliance implications.

This subtopic explains and provides practical guidance on the six potential lawful grounds for processing personal data under the United Kingdom General Data Protection Regulation (UK GDPR) (Assimilated Regulation (EU) 2016/679), also known as the legitimate grounds or conditions for processing. It also provides practical guidance on specific issues such as:

  1. legitimate interest assessments

  2. direct marketing

  3. data processing in the employment relationship

  4. supply chains under data protection law

  5. data sharing between controllers

  6. processing children’s personal data

Lawful grounds for processing personal data

There are six potentially lawful grounds for processing personal data:

  1. the data subject has given consent to the processing of their personal data for one or more specific purposes

  2. processing is necessary for the performance

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Powered by Lexis+®
Latest Practice Compliance News
View Practice Compliance by content type :

Popular documents