Legal bases

You are only allowed to process personal data when you have a legal basis to do so. The GDPR (art. 6) lists six possible legal bases (lawful grounds) for processing. Not all of them can be used when doing research. The UU is now in the process of shifting to “the performance of a task of public interest” (art. 6.1 under e GDPR) as the standard legal basis for doing research, but consent (art. 6.1 under a) is still a valid legal basis. For more information, please contact your security/privacy officer and ask for advice.