Making sure Keystone's processing is lawful
Processing personal data is only lawful under principle 1 above if it meets one of six lawful basis' conditions. Not all of these are relevant to Keystone. The most appropriate ones are that the processing is necessary:
- For the performance of our contract with the data subject (to allow us to advise the client).
- To pursue our legitimate interests, where they are not overridden by the interests or fundamental rights and freedoms of the data subjects (to run and administer our business as a law firm).
- To meet our legal compliance obligations (to allow us to comply with tax, SRA and AML rules).
In addition, we rely on the client's consent where none of the above apply. This is used primarily for direct marketing.