GDPR GDPR Lawful Bases for Processing 1 — Questions and Answers
Question 1: How many lawful bases for processing personal data are defined under Article 6 of the GDPR?
- 4
- 5
- 6 (Correct answer)
- 7
Correct answer: 6
Article 6 of the GDPR establishes exactly six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests.
Question 2: Which lawful basis applies when processing is necessary to fulfill a legal obligation to which the controller is subject?
- Consent
- Legitimate interests
- Legal obligation (Correct answer)
- Vital interests
Correct answer: Legal obligation
Article 6(1)(c) covers processing necessary for compliance with a legal obligation to which the controller is subject.
Question 3: Under GDPR, which lawful basis applies when processing is necessary to protect the vital interests of the data subject or another natural person?
- Public task
- Vital interests (Correct answer)
- Contract
- Consent
Correct answer: Vital interests
Article 6(1)(d) covers vital interests and is typically invoked in life-or-death situations where processing is needed to protect someone's life.
Question 4: Which of the following conditions must be met for consent to be a valid lawful basis under GDPR?
- Consent must be given in writing only
- Consent must be freely given, specific, informed, and unambiguous (Correct answer)
- Consent must be given by a legal representative
- Consent must be renewed annually
Correct answer: Consent must be freely given, specific, informed, and unambiguous
Article 4(11) defines consent as any freely given, specific, informed, and unambiguous indication of the data subject's wishes.
Question 5: A retailer processes customer data solely to fulfill an online purchase order. Which lawful basis under Article 6 applies?
- Legitimate interests
- Public task
- Contract (Correct answer)
- Consent
Correct answer: Contract
Article 6(1)(b) covers processing necessary for the performance of a contract to which the data subject is party.
Question 6: The 'public task' lawful basis under Article 6(1)(e) applies when processing is necessary for:
- Direct marketing by a public authority
- Performance of a task carried out in the public interest or exercise of official authority (Correct answer)
- Scientific research by any organization
- Employee monitoring by government bodies
Correct answer: Performance of a task carried out in the public interest or exercise of official authority
Article 6(1)(e) requires that the processing be carried out in the public interest or in the exercise of official authority vested in the controller.
Question 7: Which lawful basis permits processing when the controller or a third party has a legitimate interest, provided it is not overridden by the data subject's interests?
- Legal obligation
- Contract
- Legitimate interests (Correct answer)
- Consent
Correct answer: Legitimate interests
Article 6(1)(f) allows processing based on legitimate interests, subject to a balancing test against the rights and freedoms of data subjects.
GDPR GDPR Lawful Bases for Processing 1
How many lawful bases for processing personal data are defined under Article 6 of the GDPR?