Lawfulness

Processing will only be lawful if it is necessary for one of the following grounds:

for compliance with a legal obligation to which the controller is subject
- the legal obligation must be laid down by Union or State law to which the data controller is subject
for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- the legal obligation must be laid down by Union or State law to which the data controller is subject which must meet an objective of public interest, be proportionate to the legitimate aim pursued and the processing must be necessary for the performance of that task
in order to protect the vital interests of the data subject or of another natural person
- necessary to protect an interest which is essential for the data subject’s life or that of another person
for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child
- This shall not apply to processing carried out by public authorities in the performance of their tasks