Lawful Basis

Lawfulness of processing

Schools are only permitted to process personal data if they can demonstrate a lawful basis for same.

Whenever the school is processing personal data, all of the principles listed in previous sections must be obeyed.  In addition, at least one of the following bases (GDPR Article 6) must apply if the processing is to be lawful,

i)   compliance with a legal obligation

ii)  necessity in the public interest

iii) legitimate interests of the controller

iv) contract

v) consent

vi) vital interests of the data subject.

When processing special categories of personal data, the school will ensure that it has additionally identified an appropriate lawful basis under GDPR Article 9. Special category personal data are those revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.