GDPR: principles and legal bases

In short: The GDPR regulates EU-wide how personal data may be processed. Every processing operation needs a legal basis and must follow several principles.

In more detail: Personal data is any information relating to an identifiable person, such as name, email, IP address or identifiers. Processing is practically any handling of it: collecting, storing, analysing, passing on, deleting.

Not legal advice, but a general classification.

Our context: Most tools compute in the browser without data going to our server. The proposal for a privacy paragraph on this exists as a draft and has not yet been built into the privacy policy.

In Depth

Principles (Art. 5)

lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

Legal bases (Art. 6)

• Consent: voluntary, informed, revocable at any time (consent under the GDPR).
• Contract: processing is necessary for performance (for example delivery address).
• Legal obligation: for example retention of invoices.
• Vital interests, public interest.
• Legitimate interest: balancing between the controller’s interest and the person’s rights (legitimate interest).

Special categories (Art. 9)

Health, origin, religion, political opinion, biometrics: generally prohibited, with narrow exceptions (usually explicit consent).

See also: Data subject rights under the GDPR, Data processing agreement, Data protection impact assessment