Legal authority

Here you can find information about legal authority. If you have any questions about legal authority, please contact the TTO team at

Processing of personal data is only permitted when legally authorised under personal data legislation or other special legislation. 

Examples of legal authority under personal data legislation are:

  • Consent (Article 9(2) (a))
  • Public health (Article 9(2) (i))
  • Research (Article 9(2) (j))

Personal data legislation does not require consent if other legal authority applies, i.e. it is possible to choose the most appropriate legal authority. Please note, however, that there may be situations where special legislation such as healthcare legislation sets special requirements that must be followed.

The category of personal data, as well as how the personal data in question is to be processed, will determine which legal authority applies.