Principles and lawful bases

Principles of processing

Lawfulness, data minimization, purpose limitation, accuracy, storage limitation, and proactive accountability.

Lawful bases

Consent, contract, legal obligation, vital interest, public interest, or legitimate interest as the basis for each processing activity.

Informing data subjects

Clear privacy notices explaining what data is processed, for what purpose, and for how long.

What an auditor usually asks for

• Lawful basis identified for each processing activity
• Privacy notices reviewed and accessible
• Data retention periods defined
• Data minimization principle applied to forms

How to cover this block in Kimobox

1. 1Document the lawful basis for each processing activity as a version-controlled record in Kimobox.
2. 2Review privacy notices as a controlled document.
3. 3Define retention periods by type of data processed.

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

1. Regulation (EU) 2016/679, General Data Protection Regulation EUR-Lex · Applicable since 25 May 2018
2. Organic Law 3/2018 on Data Protection and guarantee of digital rights BOE-A-2018-16673 · 6 December 2018
3. Spanish Data Protection Agency AEPD · Supervisory authority