2.2 How do I ensure that the processing of personal data is lawful?

The processing of personal data is only lawful if one of the six legal grounds stated in the GMS has been met.

At the start of the investigation, it is important to carefully consider which of these legal bases is most appropriate. It is also possible that more than one basis can be identified. In this case it is a good idea to document them all.

Below is an overview of the legal grounds for the processing of personal data that are eligible for investigation:

• Those involved can explicitly  consent for the processing of his personal data. According to the GDPR, it is important to distinguish this permission from an ethical permission. For ethical reasons, you may need permission from the participants to participate in a particular study (this may be required by law or ethically recommended). Although both can be combined, this ethical consent is not necessarily the same as the consent as a legal basis for the GDPR. As a researcher, for example, you have to take into account that consent within the framework of the GDPR must meet a number of conditions in order to be valid (see also 4.2). In addition, those involved can also withdraw this permission at any time.
• Research projects that process personal data are also often  carried out in the  public interest , which means that the research leads to an increase in the knowledge and insight that benefit society (directly or indirectly). In principle, this means that the results are publicly known. When you conduct research based on government-funded resources (eg FWO, BOF, H2020, etc.), this is a strong indication that the research is being conducted in the public interest. The basis for data processing is not in the public interest if the results are transferred exclusively to another party and the knowledge acquired is intended solely for private interests.
• Processing is necessary for the protection of the legitimate interests of the institution or of a third party. It must be demonstrated that a balance of interests has been made between the legitimate interest of the data collectors and the interests of the persons whose data are being processed.
• The processing of personal data is necessary in the context of a  legal obligation  of the institution (eg a decree).
• The processing is necessary for the implementation of an agreement with those whose data are being processed. Please note, this is not about the processing agreement.