The GDPR provides six lawful bases
Processing personal data requires an appropriate legal basis. Consent is one possibility, alongside contract, legal obligation, vital interests, public interest and legitimate interests. The correct choice depends on the purpose and context; it cannot be selected merely because it is convenient.
When consent is used
- It must be freely given, specific, informed and unambiguous.
- Refusal or withdrawal must not create unfair consequences.
- An employer-employee imbalance can make valid consent difficult.
Information is still essential
A different legal basis does not remove transparency duties. People should understand who processes their data, why, for how long, with whom it is shared and how to exercise their rights. Sensitive data may also require a separate condition under Article 9 GDPR.
WhyBecause cannot choose the customer's lawful basis. That assessment belongs to the organization deciding to use the transcript.
Official sources
Use the authoritative texts below when making legal or compliance decisions.