Principles and Legal Bases

What Is Principles and Legal Bases?

Most privacy mistakes are not made by people breaking rules. They are made by people who reached for the wrong lawful basis, usually consent, because nobody had shown them the other five. This exercise puts a learner in the seat colleagues come to before they build something. Three real questions arrive from around an online marketplace: a recruiter wants to keep rejected candidates' CVs as a talent pool, a product manager has been told a recommendations feature needs a consent pop-up that would kill it, and IT operations has been asked to take a screenshot of every home worker's desktop twice a minute. Each has a different correct answer. One needs consent nobody thought to ask for, one needs no consent at all, and one cannot be fixed by any basis because it fails the balancing test on necessity before the basis question is even reached. The learner runs the legitimate interests three-part test, watches it fail honestly, and answers each colleague with a decision they can act on.

What You'll Learn in Principles and Legal Bases

• Distinguish the four common Article 6 legal bases and choose between them for a given activity
• Recognise that consent is one basis among six, and the most fragile, rather than the default answer
• Apply the legitimate interests three-part test of purpose, necessity and balance, and accept a failed result
• Explain why consent is rarely valid between an employer and an employee
• Identify the Article 5 principle that a proposed shortcut breaks, in particular purpose limitation, data minimisation and storage limitation
• Apply accountability by recording the basis and the reasoning before processing begins

Principles and Legal Bases — Training Steps

1. The Person People Ask

   Your access to the customer records system came through last week. Something else came with it that nobody mentioned: you are now the person on the floor who has done the privacy training, so colleagues have started checking things with you before they build them. That is a good problem. The questions arrive early, while a plan can still change, and almost all of them come down to the same two: what is our lawful basis, and does the plan survive the principles.

2. The Talent Pool

   The first question comes from Tomas Brandl in Talent Acquisition, still working the backend engineer hire.

3. The Reference Sheet

   Before answering, you open the one-page reference the Data Protection Officer publishes: the six lawful bases on one side, the seven principles on the other. The two halves work together. The basis makes the processing lawful at all. The principles decide whether the way you are doing it survives.

4. Deciding the Talent Pool

   Thirty-nine people sent a CV to be considered for one specific job. Tomas wants to keep those CVs for a different job that does not exist yet.

5. Answering Tomas

   The answer he needs is not just no. He has a real problem, the agency fee is real, and there is a lawful way to get most of what he wants.

6. The Recommendations Feature

   The second question arrives on WorkStream rather than by mail, from Neel Varga on the product team.

7. Consent or Something Else

   Recommending items to a customer based on what they bought from you is close to what a marketplace is for. That closeness is exactly what decides which basis fits.

8. Answering Product

   Neel needs an answer he can act on this morning, which means naming the basis and the three things that have to be true for it to hold.

9. Watching the Home Workers

   The third question is the one that will not have a comfortable answer.

10. The Three-Part Test

    Mirek's plan would rest on legitimate interests if it rests on anything. That basis is not a label you assert, it is a test you run and record, and it is designed to be failable.