6. General Principle

A data user needs a data subject's consent to process their personal data. Sensitive personal data has separate rules. Consent is not needed if processing is necessary for things like a contract with the data subject, a legal duty or their vital interests. Data must serve a lawful purpose linked to the user's activity and be adequate but not excessive.

Summary · Drafted with AI, checked against the official text on 30 Sep 2026.