Legal Grounds for Data Processing

Article 6(1) GDPR sets out the conditions that must be satisfied for the processing of personal data to be lawful. These are:

  • Consent of the data subject;
  • Necessary for the performance of a contract with the data subject or to take steps preparatory to such a contract;
  • Necessary for compliance with a legal obligation;
  • Necessary to protect the vital interests of a data subject or another person where the data subject is incapable of giving consent;
  • Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • Necessary for the purposes of legitimate interests.

Please visit:


In addition, the Romanian Data Protection Law states that processing data through IT or video surveillance systems in case of labour relations is allowed only under the following conditions: 

  • the legitimate interests of the employer are duly justified and prevail over the employees’ interests, rights and freedoms;
  • the employer has fully and expressly informed its employees about the use of monitoring systems prior to the commencement of data processing;
  • the employer has consulted the trade union(s) or the employees’ representatives about the introduction of monitoring systems prior to the commencement of data processing;
  • less intrusive means were used and were proven not to be efficient; and
  • the retention period for the personal data is proportionate with the processing purpose but no longer than 30 days, except for the situations expressly regulated or duly justified.