Lesson 2 of 6
Lesson 2 — The Seven Principles and Lawful Basis
Why a company can't just collect data 'because it might be useful one day'.
Learn it
GDPR has seven principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity & confidentiality, and accountability.
Before collecting anything, a company must pick a lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests.
Consent must be freely given, specific, informed and easy to withdraw — pre-ticked boxes don't count.
Key terms
- Lawful basis
- The legal justification for processing personal data (one of six).
- Purpose limitation
- Using data only for the purpose it was collected for.
- Data minimisation
- Collecting only what is genuinely necessary.
- Controller
- The organisation that decides why and how data is processed.
- Processor
- A third party processing data on the controller's instructions.
- ROPA
- Record of Processing Activities — the written inventory of what you process and why.
Pick the lawful basis
Same company, four different processing activities.
- 1Payroll: Legal obligation — tax law requires the employer to report salary data.
- 2Delivering an order: Contract — you cannot ship a parcel without the address.
- 3Marketing newsletter: Consent — opt-in, with a working unsubscribe link.
- 4Fraud detection: Legitimate interests — but only after a documented balancing test.
A minimised signup form
json{
"collect": ["email", "password_hash"],
"optional": ["display_name"],
"rejected": ["date_of_birth", "phone", "home_address", "gender"],
"purpose": "account creation and login",
"lawful_basis": "contract",
"retention": "until account deletion + 30 days"
}Each field must earn its place. If you cannot name the purpose and basis for a field, remove it.
Try it
Match each scenario to its most appropriate lawful basis.
Challenge
A school app asks every student for full name, home address, date of birth, phone, parent email, favourite football team and a photo. Rewrite the form applying data minimisation and give a lawful basis and retention period for each field you keep.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 4 XP (never below 20 XP). You'd earn 40 XP right now.