Legal Obligation

Legal Obligation is a lawful basis if you need to process the personal data to comply with a common law or statutory obligation.

This does not apply to contractual obligations.

The processing must be necessary. If you can reasonably comply without processing the personal data, this basis does not apply.

You should document your decision to rely on this lawful basis and ensure that you can justify your reasoning.

You should be able to either identify the specific legal provision or an appropriate source of advice or guidance that clearly sets out your obligation.