Lawful Basis

GDPR Art 6(1)(a)

Consent is only one of the six lawful bases available under GDPR, and it is not always the most appropriate one.

GDPR sets a high standard for consent, by making it opt-in, granular, and specific, among other things. If consent is difficult, you should consider looking for a different lawful basis.

However, if none of the other bases apply, our Consent Guidance shows you how to obtain consent in a GDPR-compliant way.

GDPR Art 6(1)(b)

You can rely on this lawful basis if the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

Is there a 'necessity test'?

Yes, but ‘necessary’ does not mean the processing must be essential to performing a contract. However, it must be a targeted and proportionate way of achieving that purpose. This lawful basis does not apply if there are other reasonable and less intrusive ways to meet your contractual obligations or take the steps requested.

The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests.

Please note that all contracts and agreements at the University need to be GDPR-compliant.

This means they will need to contain specific clauses covering GDPR, and go through out Contracts Approval Process. For more information have a look at  the Legal Office pages

And for template clauses, please contact the Data Protection Officer on: DPO@beds.ac.uk or legaloffice@beds.ac.uk

GDPR Art 6(1)(c)

The processing is necessary for you to comply with the law (not including contractual obligations)

Is there a 'necessity test'?

Yes, the processing must be necessary to comply with the law.

E.g.: As an employer, the University needs to process personal data to comply with its legal obligation to disclose employee salary details to HMRC.

GDPR Art 6(1)(d)

The processing is necessary to protect someone’s life.

Is there a 'necessity test'?

Yes

Example

A student has had an accident, and their personal data needs to be given to the emergency services. The student is incapable of giving consent to this data sharing.

NB: This lawful basis is only likely to apply in life or death situations.

Article 6(1)(e)

The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law

Is there a 'necessity test'?

Yes

Example

This legal basis covers data processing to perform tasks that are part of our duties as a public body. E.g. tasks required to provide an education such as data processing related to lecturing and tutoring, marking exams, awarding degrees, and research. It also covers offering counselling services to students.

Article 6(1)(f)

If personal data are to be used for purposes that do not relate to the University’s core functions or public tasks, processing may also be possible if it is necessary for the legitimate interest of the University or a third party and does not negatively affect the rights and freedoms of the people whose data you are processing.

Is there a 'necessity test'?

Yes, and it’s a 3-part test:

1. Purpose test: are you pursuing a legitimate interest?
2. Necessity test: is the processing necessary for that purpose?
3. Balancing test: do the individual’s interests override the legitimate interest?

This is not always an easy test to satisfy. If you are not sure about the outcome of the balancing test, it may be safer to look for another lawful basis. Legitimate interests will often not be the most appropriate basis for processing which is unexpected or high risk.

If you want to rely on the Legitimate Interests lawful basis, you will need to complete our Legitimate Interests Assessment Form. You can find this on in.beds along with our Legitimate Interests Guidance.

If your LIA identifies significant risks, consider whether you need to do a Data Protection Impact Assessment (DPIA) to assess the risk and potential mitigation in more detail.