We can only process personal data if we have a good reason to do so, and this has to meet 1 of the 6 Lawful Bases defined in the GDPR. Before carrying out a new data processing activity or changing the way you process personal data we already have you must consider whether it's lawful and whether any formal assessment needs to be carried out.
If you're looking to conduct a new data processing activity, or change the way you process personal data that we already have, then you should follow a Data Processing Assessment process.
A good Data Processing Assessment process will clarify:
- Whether [We Are Collecting New Personal Data] Or [We Are Using Existing Personal Data We Have In A New Way]
- Whose Data Do You Want To Process: [e.g. customer, prospect, employee]
- What Data Are You Processing: [e.g. email, full name, bank name, sexuality]
- Justification For The Processing: