According to the General Data Protection Regulation (GDPR), an entity must have a "valid lawful basis" to process personal data. If you can process data without handling any personal information of the user, then continue that way. If not, the law defines six lawful reasons for processing personal data:
Consent
Contract
Legal Obligation
Vital Interest
Public Task Interest
Legitimate Interests
Author: Trustwave Managing Consultant Brian OdianNo one basis is more important than the other or should be viewed as the path of least resistance. The basis you should operate under will come down to your purpose for processing personal data and the ongoing relationship you plan to have with the data subject.
However, one of the six is more complex to implement than the others, but it is also likely to engender the most trust: consent. Gaining consent should put the power in the hands of an individual so that they have a real and genuine choice about how their personal data is used and processed. That is backed by the GDPR requiring "positive opt-ins," so no methods of default consent are allowed.This approach presents advantages. Giving the individual control to make their own choice engenders trust and can enhance an organization's reputation because there is nothing hide, so to speak. In a world with long privacy notices and abundant product notifications, your clients may find an open and honest approach to consent to be refreshing.A checklist to help you take the right approach when it comes to consent should include the following actions.Try to ensure:
The request for consent is separate and conspicuous. (Note: As a controller, you should seek consent prior to any personal data collection, and as a processor, you should seek consent prior to any personal data processing. So, know and understand which role you are operating as for each process, either a controller or a processor.)
Consent is the most appropriate lawful basis for processing someone's personal data.
You ask people to positively opt in and that you are not using any methods of default consent.
Any associated language you use while asking for consent is clear and easy to understand, including informing individuals that they can withdraw their consent.
Clients can just as easily withdraw their consent at any time as they can provide it.
You clearly explain why you want someone's data and what you plan to do with it.
Individuals can refuse to consent without impact or detriment and that there are no preconditions around consent being required as part of a service.
You provide options to consent separately for different types of processing.
As you can see, there is a lot to consider, including what to do if you offer online services to children or how will you record consent, so careful planning is a must. Individuals also have certain rights under the GDPR which you should consider when following the consent path as a lawful basis, including the right to restrict processing, erasure and the right to be informed.Obviously before you can do any of this, you need to know where your data flows and what is subject to the GDPR. Trustwave can help with a range of offerings, including workshops, risk assessments, privacy assessments and more.
Brian Odian is managing consultant of global compliance and risk services at Trustwave. Read more Trustwave blogs here.
Newly appointed U.S. Director of National Intelligence Tulsi Gabbard has been urged by Sen. Ron Wyden, D-Ore., and Rep. Andy Biggs, R-Ariz., to oppose the UK's reported order for Apple to develop a backdoor that would enable government access to encrypted iCloud data, which they argued to be detrimental to U.S. government and citizen data security, according to The Register.
SecurityWeek reports that open-source database management system PostgreSQL has been impacted by a new zero-day flaw, tracked as CVE-2025-1094, which has been leveraged as part of the attacks against vulnerable BeyondTrust Remote Support systems that impacted the U.S. Treasury Department.
Operations of the Virginia Attorney General's office were reported by the Richmond Times-Dispatch to have been significantly impacted by a cyberattack this week, which took down most of its computer systems, according to The Associated Press.
