GV007Lawful basis register

The record naming, for each stream of data the program collects and each use it puts that data to, the ground it rests on and the condition the jurisdiction attaches to that ground. Written before the collection starts, and held in a form that can be shown rather than asserted.

Pillar: GV | Governance and mandate
Sources cited: 9
Added: 30 AUGUST 2026
Updated: 20 SEPTEMBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV007/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be recorded for each stream the program collects, before it collects it, and the register has to survive the article 5(2) test of being shown rather than asserted.
GV007/BEMandatory	Belgium	Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026	Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own.	Four purposes are listed and the list is closed: unlawful or defamatory acts, the confidential economic interests of the undertaking, the security and technical functioning of its systems, and good faith observance of the rules it has set for using the technology.
GV007/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Only data directly necessary for the employment relationship may be processed, and no exception to that test can be made even with the employee’s consent.
GV007/DEMandatory	Germany	Urteil 8 AZR 209/21Bundesarbeitsgericht, Eighth Senate · read 16 Aug 2026	That legitimate interests can carry a test on live employee data, and that the national employment provision fails the article 88 conditions.	The national employment provision cannot carry the register on its own: the ground recorded has to be one that stands under article 6 itself, the employer’s legitimate interests among them.
GV007/NOMandatory	Norway	Arbeidsmiljøloven, sections 9-1 and 9-2Storting · read 29 Aug 2026Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	That a control measure needs objective grounds in the undertaking and must not be a disproportionate burden, and that it is discussed with the elected representatives, notified with its expected duration, and evaluated with them at intervals.	A control measure rests on objective grounds in the circumstances of the undertaking and must not be a disproportionate burden on the person subject to it. No instruction and no agreement may depart from that to the worker’s detriment, so an agreement cannot be the ground for reaching further.
GV007/PLMandatory	Poland	Kodeks pracy, article 22(2)Sejm of the Republic of Poland · read 20 Sep 2026Kodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026	That image recording at work is open for four purposes only, one of them keeping secret information whose disclosure could harm the employer, that its purposes, scope and manner are fixed in the collective agreement, the work regulations or an announcement, that it is notified two weeks before it starts and handed to each worker before they are admitted to work, and that recordings are kept three months.	The purposes, the scope and the manner in which monitoring is applied are set in the collective agreement or in the work regulations, or in an announcement where the employer is bound by neither. The code names the instrument the record is kept in, and names the same one for image recording, for electronic mail, and for every other form of monitoring.