Foreword
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) aims to harmonise data protection legislation across EU member states, enhancing the privacy rights for individuals. It applies to organisations processing Personal Data which have an establishment within the EU and also those organisations which operate outside the EU but offer goods or services to, or monitor the behaviour of, individuals in the EU. The GDPR is applicable from 25 May 2018. The GDPR sets out six lawful grounds for processing, one of which is processing under the Legitimate Interests of a Controller, including those of a Controller to which the Personal Data may be disclosed, or of a Third Party.
