In order to be lawful, the processing operations must be based on one of the following conditions:
- The data subject has consented to the processing of his/her personal data for one or more specific purposes.
- The processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the request of the data subject.
- The processing is necessary to comply with a legal obligation (clear and precise) to which the controller is subject.
- The processing is necessary to safeguard the vital interests of the data subject or of another person.
- The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- The processing is necessary for the legitimate interests pursued by the controller (e.g: marketing, anti-fraud, processing of the customers or employees data, processing security, etc.)
The provisions concerning consent have been extended by the general data protection regulation (see consent section) and certain processing operations require particular attention (see processing of sensitive data section).