What is the legal obligation?
This legal basis applies when the processing is imposed by applicable law.
Example: The Labor Code requires the employer to maintain a single register of personnel. This document must contain various personal data (name, first name, nationality, gender, job, qualifications, etc.). The data controller must maintain this register; otherwise, they would not comply with their legal obligation and could face criminal penalties.
When to chose the legal obligation?
The obligation must be:
Defined by European or national law;
Imperative (the data controller must have no other choice but to comply with this obligation);
Clear and specific (the text must at least specify the purpose of the processing);
Intended for the data controller, not for the data subjects.