GV007Lawful basis register

The record naming, for each stream of data the program collects and each use it puts that data to, the ground it rests on and the condition the jurisdiction attaches to that ground. Written before the collection starts, and held in a form that can be shown rather than asserted.

Pillar: GV | Governance and mandate
Sources cited: 19
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV007/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be recorded for each stream the program collects, before it collects it, and the register has to survive the article 5(2) test of being shown rather than asserted.
GV007/BEMandatory	Belgium	Convention collective de travail n° 81 du 26 avril 2002Conseil national du Travail · read 29 Aug 2026	Four purposes for which network communication data may be monitored, collection in the aggregate rather than by name, and individualization as a separate operation with conditions of its own.	Four purposes are listed and the list is closed: unlawful or defamatory acts, the confidential economic interests of the undertaking, the security and technical functioning of its systems, and good faith observance of the rules it has set for using the technology.
GV007/HRMandatory	Croatia	Zakon o radu, članci 29, 150, 151, and 153Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That workers’ personal data are collected, processed, used, and transmitted only where a law provides or where needed for the rights and obligations of the employment, that the employer sets out in advance in the work rules which data and for what purpose, that an employer with at least twenty workers appoints a person trusted by the workers to oversee that processing, that the employer consults the works council before an important decision, the introduction of new technology among them, and that a decision on collecting, processing, using, and transmitting data on the worker, and on appointing the overseeing person, needs the works council’s prior consent, replaceable by a court or arbitration decision.	Workers’ personal data are collected, processed, used, and transmitted only where this or another law provides or where needed for the rights and obligations of the employment, and the employer sets out in advance in the work rules which data are collected for that purpose and for what; only the employer or a person it specially authorizes processes them. Consent is seldom an adequate basis for processing workers’ data, the dependence of the worker standing in the way; the employer relies on another basis, such as contract or a demonstrated legitimate interest.
GV007/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	Only data directly necessary for the employment relationship may be processed, and no exception to that test can be made even with the employee’s consent.
GV007/DEMandatory	Germany	Urteil 8 AZR 209/21Bundesarbeitsgericht, Eighth Senate · read 16 Aug 2026	That legitimate interests can carry a test on live employee data, and that the national employment provision fails the article 88 conditions.	The national employment provision cannot carry the register on its own: the ground recorded has to be one that stands under article 6 itself, the employer’s legitimate interests among them.
GV007/GRMandatory	Greece	Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026	That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors.	Employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance; consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically, clearly distinct from the contract, with information on the purpose and the right to withdraw; a collective agreement may provide a basis within article 88(2).
GV007/HUMandatory	Hungary	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Consent is a basis for workplace processing only exceptionally, where the employee gains an unconditional advantage and suffers no disadvantage from refusing; checks of employees rest on the employer’s legitimate interest with a documented balancing test in five steps. The employer may require a statement or personal data from the employee only where material to the establishment, performance, or termination of the employment or to a claim under the Act, and informs the person in writing of the processing; a restriction of the employee’s personality right stands only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate.
GV007/LUMandatory	Luxembourg	Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026	That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence.	Processing for the surveillance of employees in the employment relationship rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, and the employer undertakes formally not to use the data for a purpose other than the one stated in the prior information.
GV007/NOMandatory	Norway	Arbeidsmiljøloven, sections 9-1 and 9-2Storting · read 29 Aug 2026Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	That a control measure needs objective grounds in the undertaking and must not be a disproportionate burden, and that it is discussed with the elected representatives, notified with its expected duration, and evaluated with them at intervals.	A control measure rests on objective grounds in the circumstances of the undertaking and must not be a disproportionate burden on the person subject to it. No instruction and no agreement may depart from that to the worker’s detriment, so an agreement cannot be the ground for reaching further.
GV007/PLMandatory	Poland	Kodeks pracy, article 22(2)Sejm of the Republic of Poland · read 20 Sep 2026Kodeks pracy, article 22(3)Sejm of the Republic of Poland · read 20 Sep 2026	That image recording at work is open for four purposes only, one of them keeping secret information whose disclosure could harm the employer, that its purposes, scope and manner are fixed in the collective agreement, the work regulations or an announcement, that it is notified two weeks before it starts and handed to each worker before they are admitted to work, and that recordings are kept three months.	The purposes, the scope and the manner in which monitoring is applied are set in the collective agreement or in the work regulations, or in an announcement where the employer is bound by neither. The code names the instrument the record is kept in, and names the same one for image recording, for electronic mail, and for every other form of monitoring.
GV007/ROMandatory	Romania	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Monitoring by means of electronic communications or video surveillance at the workplace on the employer’s legitimate interest is permitted only where the interest is duly justified and prevails over the rights of the persons concerned, the employees have received prior, mandatory, complete, and explicit information, the union or the employee representatives have been consulted before the system is introduced, less intrusive forms have previously proven ineffective, and retention is proportionate and no longer than 30 days save where the law provides otherwise or a case is duly justified.
GV007/SEMandatory	Sweden	Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026	That surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6, that the balancing is made purpose by purpose, that the integrity interest at a workplace weighs heavily as a starting point since an employee does not usually expect to be watched, and that surveillance to handle medicine incidents prevailed because it was limited to relevant areas, access was limited to three post-holders, logged, and used as a last resort, and the activity was one where employees could expect cameras more than usual.	The bases for processing to control employees are the balancing of interests or, for a public authority, public interest; consent is not one an employer can use. In the balancing, security reasons weigh more than efficiency reasons. Where cameras serve several purposes the legal basis is examined purpose by purpose, and surveillance to direct work and check how employees perform their tasks normally has none.
GV007/CHMandatory	Switzerland	Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026	That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches.	An infringement of personality is unlawful unless justified by the person’s consent, by an overriding private or public interest, or by law; processing is lawful, in good faith, proportionate, and for a purpose recognizable to the person.