Answer
Your company/organisation can only process personal data in the following circumstances:
- with the consent of the individuals concerned;
- where there is a contractual obligation (a contract between your company/organisation and a client);
- to meet a legal obligation under EU or national legislation;
- where processing is necessary for the performance of a task carried out in the public interest under EU or national legislation;
- to protect the vital interests of an individual;
- for your organisation’s legitimate interests, but only after having checked that the fundamental rights and freedoms of the person whose data you’re processing aren’t seriously impacted. If the person’s rights override your interests, then processing cannot be carried out based on legitimate interest. The assessment as to whether your company/organisation has a legitimate interest for processing override those of the persons concerned depends on the individual circumstances of the case.
Examples
Consent
Your company/organisation offers a music app and ask for citizens’ consent to process their musical preferences in order to suggest tailored songs and possible concerts to them.
Contractual obligation
Your company/organisation sell goods online. It can process data that is necessary to take steps at the request of the individual prior to entering into the contract and for the performance of the contract. So you can process the name, delivery address, credit card number (if payment by card), etc.
Legal obligation
You own a company with employees. In order to obtain social security cover, the law obliges you to provide personal data (for example weekly income of your employees) to the relevant authority.
Public interest
Example: a professional association such as a bar association or a chamber of medical professionals vested with an official authority to do so may carry out disciplinary procedures against some of their members.
Vital interests of a person
A hospital is treating a patient after a serious road accident; the hospital doesn't need his consent to search for his ID to check whether that person exists in the hospital's database to find previous medical history or to contact his next of kin.
Your organisation’s legitimate interests
Your company/organisation ensures its network security by monitoring the use of its employees’ IT devices. Your company/organisation may legitimately process personal data for that purpose, only if the least intrusive method is chosen as regards the privacy and data protection rights of your employees, for example, by limiting the accessibility of certain websites. (Note that this can’t be done in EU Member States where national law sets out stricter rules for processing in the employment context).