A legal basis is requi­red for the pro­ces­sing of per­so­nal data, which may be (1) a con­tract or (2) a decla­ra­ti­on of con­sent with the indi­vi­du­al. Sel­ec­ted pro­ces­sing ope­ra­ti­ons may also be car­ri­ed out in the over­ri­ding inte­rest of the pro­ces­sor. When pro­ces­sing sen­si­ti­ve data, be sure to obtain advice.

Sen­si­ti­ve data includes, but is not limi­t­ed to: racial and eth­nic ori­gin, poli­ti­cal opi­ni­ons, reli­gious or phi­lo­so­phi­cal beliefs, or trade uni­on mem­ber­ship; gene­tic data; bio­me­tric data that uni­que­ly iden­ti­fies a natu­ral per­son; health data; or data con­cer­ning sex life or sexu­al orientation.

Pre­vious artic­le: Employee Data Pro­tec­tion Awa­re­ness: #1 Prin­ci­ples of the GDPR

Next artic­le: Employee Data Pro­tec­tion Awa­re­ness: #3 Trans­pa­rent Processing