Processing may be performed provided that consent is given and the processing meets the following conditions according to which the data have to be:
- obtained and processed fairly and lawfully;
- collected for specific, explicit and legitimate purposes, and subsequently processed in accordance with these purposes;
- collected in an adequate, relevant, and non-excessive way, in view of the purposes for which they are collected;
- accurate, comprehensive and, when necessary, kept up to date;
- stored in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected, or for which they are further processed. Personal data can only be stored beyond this necessary period for processing for historical, statistical or scientific purposes;
- kept secure.
Personal data processing is lawful only if and to the extent that it fulfills at least one of the following conditions:
- the data subject has consented to the processing of his personal data for one or more specific purposes;
- it performs either a contract to which the data subject is a party or steps taken at the request of the data subject prior to entering into a contract;
- it complies with any legal obligation to which the data controller is subject;
- it protects the data subject’s or another natural person’s vital interests;
- it performs a public service mission entrusted to the data controller or the data recipient;
- it pursues the data controller’s or a third party’s legitimate interest, provided this is not incompatible with the interests or the fundamental rights and liberties of the data subject.
Please visit: https://gdpr-info.eu/art-5-gdpr/