To give context to the concepts of purposes and legal bases, we can say that an organization performs business processes for specific purposes, with lawfulness determined by certain legal bases.
Purpose assets
Purpose assets describe the reasons for which other assets are created or for which other assets exist, for example:
- Business purpose: The use of personal information for the operational purposes of a business or a service provider. Business purposes include:
- Auditing
- Detecting security incidents
- Debugging
- Short-term transient use
- Performing services, for example, customer service, order fulfillment, or processing payments.
- Internal research for technological development, or maintaining quality or safety of a device or service.
- Commercial purpose: To advance a person’s commercial or economic interests, enabling or effecting, either directly or indirectly, a commercial transaction.
There are important legal implications for Purpose assets. For example, the definition of a Purpose asset might forbid you from accommodating a data subject's right to be forgotten.
The following image shows an example list of Purpose assets.
Note The Purpose assets you create will be available for selection when requesting access to data sets, during data shopping.
- Upon the request of a data subject, you must communicate the relevant purpose for using the data subject's personal information.
- You cannot use a data subject's personal information for any purposes other than that for which the personal information is collected.
Legal Basis assets
Legal Basis assets describe the lawfulness of business processes that produce and consume personal information. Personal information can be processed only if, and to the extent that, at least one legal basis applies.
The Legal Basis asset type has the following attributes and relations in the global assignment:
- Description
- Note
- Legal Basis determines lawfulness of Business Process.
- Legal Basis complies with / applies to Governance Asset