Principles and Legal Bases

What Is Principles and Legal Bases?

Most privacy mistakes come from reaching for the wrong lawful basis, usually consent, because nobody showed you the other five. Three colleagues bring questions before they build anything: a recruiter wants to keep rejected CVs as a talent pool, a product manager has been told a recommendations feature needs a consent pop-up, and IT operations has been asked to screenshot every home worker's desktop twice a minute. Each has a different answer. You will run the legitimate interests three-part test, watch it fail honestly, and give each colleague a decision.

What You'll Learn in Principles and Legal Bases

• Distinguish the four common Article 6 legal bases and choose between them for a given activity
• Recognise that consent is one basis among six, and the most fragile, rather than the default answer
• Apply the legitimate interests three-part test of purpose, necessity and balance, and accept a failed result
• Explain why consent is rarely valid between an employer and an employee
• Identify the Article 5 principle that a proposed shortcut breaks, in particular purpose limitation, data minimisation and storage limitation
• Apply accountability by recording the basis and the reasoning before processing begins

Principles and Legal Bases — Training Steps

1. The Person People Ask

   Your access to the customer records system came through last week. Something else came with it that nobody mentioned: you are now the person on the floor who has done the privacy training, so colleagues have started checking things with you before they build them. That is a good problem. The questions arrive early, while a plan can still change, and almost all of them come down to the same two: what is our lawful basis, and does the plan survive the principles.

2. The Talent Pool

   The first question comes from Tomas Brandl in Talent Acquisition, still working the backend engineer hire.

3. The Reference Sheet

   Before answering, you open the one-page reference the Data Protection Officer publishes: the six lawful bases on one side, the seven principles on the other. The two halves work together. The basis makes the processing lawful at all. The principles decide whether the way you are doing it survives.

4. Deciding the Talent Pool

   Thirty-nine people sent a CV to be considered for one specific job. Tomas wants to keep those CVs for a different job that does not exist yet.

5. Answering Tomas

   The answer he needs is not just no. He has a real problem, the agency fee is real, and there is a lawful way to get most of what he wants.

6. The Recommendations Feature

   The second question arrives on WorkStream rather than by mail, from Neel Varga on the product team.

7. Consent or Something Else

   Recommending items to a customer based on what they bought from you is close to what a marketplace is for. That closeness is exactly what decides which basis fits.

8. Answering Product

   Neel needs an answer he can act on this morning, which means naming the basis and the three things that have to be true for it to hold.

9. Watching the Home Workers

   The third question is the one that will not have a comfortable answer.

10. The Three-Part Test

    Mirek's plan would rest on legitimate interests if it rests on anything. That basis is not a label you assert, it is a test you run and record, and it is designed to be failable.