Lawful processing conditions for personal data

Before you start to collect or use people's data, you need to identify and document a 'lawful processing condition' (or 'lawful basis') that you can rely on. Doing this is part of your obligation under the 'lawfulness, fairness & transparency' principle. 

There is a common misconception that you need people's consent before you can do anything with their data - as you will see from the list below consent is just one of conditions that you may be able to rely on. 

Section 7 of the Law sets out the requirements for processing to be lawful. It refers to Schedule 2 of the Law and the conditions for processing within that Schedule.

Do not start processing any personal data unless you have clearly established and documented details of the relevant condition/s.

The majority of conditions require that ‘the processing is necessary’ in order to be able to rely upon them. This means that if you could reasonably achieve the same purpose without the processing you cannot rely upon that condition.

The conditions for processing to be lawful under the Law Enforcement Ordinance differs to those required by the Law. When processing personal data for a Law Enforcement purpose under the Law Enforcement Ordinance please consult section 5 and Schedule 2 of the Ordinance. 
 
There is a separate set of conditions for when you are processing special category data (i.e. racial or ethnic origin; political opinion; religious or philosophical belief; trade union membership; genetic data; biometric data; health data; sex life; criminal data) 

For personal data not considered to be special category data, you must satisfy at least one of the conditions below, or view a printable version:

Consent

The data subject has requested or given consent to the processing of the personal data for the purpose for which it is processed.

Contractual

The processing is necessary for the performance of a contract to which the data subject is a party or that is in the interests of the data subject.
 

Vital interests

The processing is necessary to protect the vital interests of the data subject or other individual.
 

Public function

The processing is necessary for the exercise or performance of a public function or task carried out in the public interest by a public authority.

Legitimate interests

The processing is necessary for the purposes of legitimate interests (not applicable for public authorities).
 

Law

The processing is necessary for the exercise of a right, power or duty imposed by law.

 Public domain

The information contained in the personal data has been deliberately made public by the data subject.

Enactment

The processing is necessary for the exercise of a right or power imposed by enactment.

Court order / judgement

The processing is necessary in order to comply with a court order or judgement.

Health / Social Care

The processing is necessary for a health or social care purpose.

Public Health

The processing is necessary for a health or social care purpose.

Legal proceedings / Court / Tribunal / Legal Advice / Legal Rights

The processing is necessary for the purpose of, or in connection with legal proceedings (including prospective legal proceedings), discharging any court or tribunal functions, obtaining legal advice or otherwise for the purposes of establishing, exercising or defending legal rights.

Administration of justice / Crown function

The processing is necessary for the administration of justice or the exercise of any function of the Crown, a Law Officer of the Crown, the States or a public committee.

Law enforcement

The processing is necessary for a law enforcement purpose.

Not-for-profit

The processing is in the context of not-for-profit organisations that exist for political, philosophical, religious or trade-union purposes.

 Historical / Scientific

The processing is necessary for historical or scientific purposes.

Equal opportunity

The processing is necessary for the purposes of equal opportunity.

Regulation / enactment

The processing is authorised by regulation or other enactment - see tables in this document.