Processing is only lawful if and to the extent that at least one of the following situations applies:
-
- The data subject has given their consent to the processing of their personal data for one or more specific purposes;
-
- Processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual steps at the request of the data subject;
-
- Processing is necessary for compliance with a legal obligation to which the controller is subject;
-
- Processing is necessary for the protection of the vital interests of the data subject or another natural person;
-
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the person responsible for processing;
-
- Processing is necessary for the purposes of the legitimate interests pursued by the person responsible for processing or by a third party.
The request for consent should be understood as a last resort. In other words, only data that is strictly necessary for legitimate processing without a request for consent should ever be requested.