Learning 2 – Principles and lawful processing
| Site: | MyStudentSite Moodle |
| Course: | UK Data Protection Interactive SCORM |
| Book: | Learning 2 – Principles and lawful processing |
| Printed by: | Guest user |
| Date: | Tuesday, 4 August 2026, 11:46 PM |
1. Section 2: Principles and lawful processing
Section 2: Principles and lawful processing
The rules that determine whether personal data may be used and how it must be managed.
Learning outcomes
By the end of this section, you should be able to:
- explain and apply the seven data protection principles;
- identify the seven Article 6 lawful bases;
- explain why consent is not automatically the best lawful basis;
- describe the additional requirements for special category data; and
- document a reasoned lawful-basis decision.
The principles describe the standard of behaviour expected throughout the data lifecycle. A lawful basis provides the legal justification for a particular processing purpose. Both are required.
Official reference points
- ICO: A guide to the data protection principles
- ICO: A guide to lawful basis
- ICO: Recognised legitimate interest
- ICO: Special category data
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.1. 2.1 The seven data protection principles
2.1 The seven data protection principles
The standards that apply throughout the personal-data lifecycle.
- Lawfulness, fairness and transparency
Use data legally, avoid unjustified harm or surprise, and be open about what is happening. - Purpose limitation
Collect data for specified, explicit and legitimate purposes and avoid incompatible reuse. - Data minimisation
Use only data that is adequate, relevant and limited to what is necessary. - Accuracy
Take reasonable steps to keep data accurate and, where necessary, up to date. - Storage limitation
Do not retain identifiable personal data longer than necessary. - Integrity and confidentiality
Use appropriate technical and organisational security measures. - Accountability
Take responsibility and keep evidence that demonstrates compliance.
Applying the principles together
A single action may involve several principles. For example, collecting detailed medical histories for a simple event registration could be unfair, excessive, poorly secured and retained too long.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. A form asks for passport details when only an email address is required. Which principle is most obvious?
Suggested answer: Data minimisation.
2. A customer database contains outdated addresses and no correction process. Which principle is most obvious?
Suggested answer: Accuracy.
3. An organisation has good controls but cannot show any policies, records or decisions. Which principle is weak?
Suggested answer: Accountability.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.2. 2.2 The seven lawful bases
2.2 The seven lawful bases
The legal justification required for each processing purpose.
| Basis | Use when processing is necessary because… | Example |
|---|---|---|
| Consent | the person has made a valid, informed and unambiguous choice. | Optional email marketing with a clear opt-in. |
| Contract | it is needed for a contract with the person or requested pre-contract steps. | Using an address to deliver an online order. |
| Legal obligation | it is needed to comply with a legal duty. | Keeping certain tax or employment records. |
| Vital interests | it is needed to protect someone's life. | Sharing urgent medical information when a person cannot consent. |
| Public task | it is needed for an official function or task in the public interest with a basis in law. | A public authority performing a statutory function. |
| Recognised legitimate interest | it is needed for a listed recognised public-interest purpose. | Certain disclosures requested by a public body in support of a public task, where the statutory conditions are met. |
| Legitimate interests | it is needed for a legitimate interest and the balancing test favours the processing. | Proportionate fraud prevention or network security in suitable circumstances. |
Choosing and recording the basis
- Define the exact purpose.
- Test whether the processing is genuinely necessary.
- Compare the bases and choose the one that best matches the facts.
- Record the reasoning before processing.
- Reflect the basis in the privacy information.
- Review the decision if the purpose or method changes.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.3. 2.3 Consent, special category data and criminal offence data
2.3 Consent, special category data and criminal offence data
Additional safeguards for higher-risk forms of personal data.
What makes consent valid?
- It is freely given, with a genuine choice.
- It is specific and informed.
- It is indicated by a clear affirmative action.
- It is separate from unrelated terms where appropriate.
- It is recorded so the organisation can demonstrate it.
- Withdrawal is as easy as giving consent.
Special category data
An organisation normally needs:
- an Article 6 lawful basis; and
- a separate Article 9 condition.
Depending on the Article 9 condition, the organisation may also need to meet a condition in Schedule 1 of the DPA 2018 and may need an appropriate policy document.
Criminal offence data
The organisation needs an Article 6 lawful basis and must have official authority or meet a relevant condition in Schedule 1 of the DPA 2018. Access and retention should be tightly controlled.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. Why may employee consent be difficult to rely on?
Suggested answer: An imbalance of power can mean the employee does not have a genuine free choice.
2. Is an Article 6 lawful basis alone enough for special category data?
Suggested answer: Normally no. A separate Article 9 condition is also required.
3. Can a person withdraw consent?
Suggested answer: Yes. Withdrawal must be possible and should be as easy as giving consent.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.
1.4. 2.4 Applied activity: lawful-basis workshop
2.4 Applied activity: lawful-basis workshop
Practise choosing a basis and explaining the decision.
Activity: Select and justify the basis
For each purpose, identify the most likely lawful basis and explain why the processing is necessary. Some cases require more facts before a final decision.
- An online retailer uses a customer's delivery address to fulfil an order.
- A college records attendance to perform its statutory and educational functions.
- A business sends optional promotional emails to people who have clearly opted in.
- A security team reviews access logs to detect attacks and protect its network.
- A manager wants to publish every employee's date of birth on the intranet because it may improve morale.
- An employer records sickness information to manage absence and workplace adjustments.
Open the answer guidance
- Delivery address: contract is likely to apply because the data is needed to fulfil the order.
- College attendance: public task or legal obligation may apply, depending on the exact legal function and institution.
- Optional promotional email: consent may apply, while electronic marketing rules must also be considered.
- Security logs: legitimate interests may apply where necessity and balancing are properly assessed; other bases may apply to some organisations.
- Publishing all dates of birth: likely unnecessary and disproportionate. A lawful basis does not remove the need to satisfy the principles.
- Sickness information: an Article 6 basis plus an Article 9 health-data condition is normally required.
Create a lawful-basis record
For one scenario, produce a short record containing:
- purpose of processing;
- categories of personal data;
- people affected;
- selected Article 6 basis;
- necessity explanation;
- additional condition where required;
- expected retention period;
- main safeguards; and
- review date.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.