Welcome to the Gibraltar Regulatory Authority website

GDPR GUIDANCE (6) IDENTIFYING THE LAWFUL BASIS

The General Data Protection Regulation (the "GDPR") came into force on the 25th May 2018, replacing the existing data protection framework under the EU Data Protection Directive. This is the sixth of a series of Guidance Notes that the Gibraltar Regulatory Authority, as the Information Commissioner, has issued. To collect and use personal data legitimately under the GDPR and the Data Protection Act 2004, organisations need to have a 'lawful basis'. This Guidance Note provides general guidance on the lawful bases that are available for organisations to rely on, in a practical and concise manner.

Downloads