...
This article is written in collaboration with a law agency. However, it is intended for general information purposes only. It does not constitute a client-attorney relationship or personalized legal advice.
In order to process personal data, you must have a legal ground for doing it. As a business or website owner, it’s likely that you’ll be able to use one of the following legal grounds:
1. The data subject has given consent to you for processing their personal data for a specific purpose
Example: the typical “Sign me up to the newsletter” checkbox. Read more about asking consent here.
Keep in mind that your customers have the right to withdraw any of their given consents at any time!
...
Also note that for processing sensitive data, some special rules apply – read more in GDPR Art. 9.
...