Module 1 · Chapter 3

Lawful Bases and Recognised Legitimate Interests

Each use of personal data needs a reason the law accepts. This chapter shows those reasons, why a supplier has none of its own, and how a care home shares data safely.

≈ 8 min read 8-question test

In this chapter

  • The lawful bases, and what each one needs
  • Why a processor acts only on what its customer says in writing
  • How a care home shared its rota with the council after a fall

3.1Lawful bases in one paragraph

Each use of personal data needs a lawful basis: a reason the law accepts. The controller picks it, because the controller decides why the data is used. For the rota data, that is Corrandale. Tennerby is just its processor, so it has no basis of its own.

So Tennerby may use the data only as Corrandale tells it. The Data Processing Agreement says how Corrandale must tell it.

Key point

Corrandale needs a lawful basis for each use of its care workers’ data. Tennerby has none of its own, so it acts only on Corrandale’s written instructions.

Also in this chapter

  1. The lawful bases and what each one needs
  2. Why a processor has no basis of its own
  3. Sharing a rota after a resident’s fall
  4. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →