In accordance with Article 6 of the GDPR, personal data processing is lawful if at least one of the processing bases described below applies:
- the existence of evidenced consent of the data subject (i.e. the physical living person), whose personal data is processed
- processing is necessary in order to enter into a contract to which the data subject is a contractual party or to take action at the request of the data subject before or after a contract is entered into force
- processing is necessary to comply with a statutory obligation of the Data Controller or Data Processor as relevant
- processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or Data Processor as relevant, unless such interest overrides the interest or fundamental rights and freedoms of the data subject who require the protection of personal data, in particular if the subject of the data is a child
- processing is necessary to safeguard the vital interest of the data subject or other natural person
- processing is necessary for the performance of an obligation performed in the public interest or in the exercise of public authority assigned to the Company.
Based on the above, Baker Tilly seeks to ensure that each type of personal data processing we perform is supported by one or more of the above legal bases. With very few exceptions, the legal bases applicable to our operational routines and the resulting personal data processing we conduct are those described in the first four bullets.