A startup claims it only needs a privacy notice when consent is the lawful basis and skips notices for contract and legitimate-interest processing. What is wrong with that view?
Select an answer to reveal the explanation.
Short Explanation
Transparency is not a consent-only club. Whether you rely on contract, legitimate interests, or consent, people still need clear information about what you do with their data. Skipping the notice because “we’re not asking for consent” misses the point of fairness and information duties.
Full Explanation
Articles 12–14 transparency duties apply regardless of whether the lawful basis is consent, contract, legal obligation, vital interests, public task, or legitimate interests. A startup that issues notices only for consent processing misunderstands the GDPR: people still need controller identity, purposes, bases, recipients, retention, rights, and transfer information when processing rests on contract performance or legitimate interests. Civic contractors delivering public services and private startups shipping SaaS features share that duty across the entire Article 6 menu, not only where a consent banner appears.
Notices are not limited to special-category data, so ordinary personal data still require transparency. Transparency is not owed only when data are shared with processors; controller-to-data-subject information is independent of Article 28 contracting. Contract-basis processing does not permanently exempt controllers from Articles 13 and 14.
Exam caveat: notice content can emphasise different rights by basis—withdrawal language for consent, objection language for legitimate interests—but the existence of the information duty does not turn on basis choice. Processor contracts also do not replace the public-facing notice.
Operational check: inventory all purposes and bases in the record of processing activities, ensure each purpose has notice coverage on the live site, remove any internal policy that ties “publish notice” solely to consent collection events, and re-review after each feature launch that adds a non-consent basis.