According to Art. 6(1) GDPR, the processing of personal data is only lawful if at least one of the conditions listed therein is met. The most important legal bases include the data subject's consent (lit. a), the necessity for the performance of a contract (lit. b), and the pursuit of legitimate interests (lit. f). The choice of the appropriate legal basis and its careful documentation are decisive for every processing activity. If legitimate interest is to be used, a careful balancing test is required and must be documented.

The correct identification and application of the appropriate legal basis is a prerequisite for meeting the complex legal frameworks.

As your external DPO, we advise you on the systematic review and determination of the relevant legal bases for your data processing activities. We also support you in applying legitimate interest, which includes jointly conducting and documenting the necessary balancing test.

Where consent serves as the legal basis, we also advise you on the aspects of a compliant consent management system.