EUGDPRLawful BasesEASYFree question
Which of the following is an example of processing based on legal obligation?
- A.Analyzing website traffic for marketing, per Article 9(2)(h), which allows processing of health data for employment vetting purposes without any confidentiality obligation
- B.Retaining employee tax records as required by tax law
- C.Collecting customer preferences for personalization, per Article 21(2), which allows objection to direct marketing only if the data subject pays an opt-out fee
- D.Sending marketing emails to customers
Why B is correct
Retaining employee tax records as required by tax legislation is a clear example of processing necessary for compliance with a legal obligation.
Know someone studying for GDPR? Send them this one.