Lawfulness

Processing is lawful if at least 1 legal justifications applies.

Data subject has given consent for processing or

Processing is necessary (for performance of contract, legal compliance, vital interest, in public interest, controller’s legitimate interest)

Difficulties regarding processing for new purpose.

Controller shall ascertain compatibility between new purpose and original purpose

If impossible to ascertain compatibility with original purpose, controller needs:

  • fresh consent or
  • legal obligation