A startup claims it only needs a privacy notice when consent is the lawful basis and skips notices for contract and legitimate-interest processing. What is wrong with that view?
Select an answer to reveal the explanation.
Short Explanation
Transparency is not a consent-only club. Whether you rely on contract, legitimate interests, or consent, people still need clear information about what you do with their data. Skipping the notice because “we’re not asking for consent” misses the point of fairness and information duties.
Full Explanation
The GDPR’s transparency and information obligations in Articles 12–14 apply to processing of personal data generally; they are not limited to consent-based processing. Controllers must provide required information whether the lawful basis is consent, contract, legitimate interests, or another Article 6 ground. Special-category status or processor sharing does not redefine when notices are owed, and contract-basis processing does not create a permanent exemption from Articles 13 and 14.