Legal basis for making use of personal data

Organisations must have a valid lawful basis in order to process personal data to make use of personal data. There are six available lawful bases; no single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on an organisation’s purpose and relationship with the individual.

Organisations must determine what lawful basis are appropriate before they begin to make use of personal data, and those decisions should be documented.

The lawful basis which the University relies upon for making use of personal data are set out in this set of documents. If you have any questions about how the University makes use of personal data, please email dataprot@st-andrews.ac.uk. 

 The University’s privacy notices also include details of the lawful basis for processing as well as describing the purposes of the processing.

Legal basis documents