Before you use personal data, you need a lawful basis for doing so. The GDPR provides six: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Most everyday business use relies on contract, legal obligation or legitimate interests. Choose the right basis before you start.

People also have strong rights over their own data. These include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights around automated decision-making.

Requests to exercise these rights carry legal deadlines, so if you receive one, pass it to the right contact promptly.

Real-life example

A customer emails and says please delete my account and all my data. That is a request to exercise the right to erasure. Rather than leaving it in an inbox, log it and pass it to the right person the same day, because the clock on the legal deadline has already started.