GDPR (EU Data Protection Regulation) - lawful basis for processing personal data

Summary

Consent /Contract / Legal Obligation / Legitimate Interest

Content

As the GDPR enforcement date approaches, I guess we are not the only HCM Cloud customer documenting our data privacy strategy and I wanted to share some critical items where we are interested in understanding how others approached the topic.

First one if the "lawful basis for processing personal data". The regulation includes several options including the following that can potentially apply to an HCM/HRIS solution (I skipped d and e that are not relevant): 

6 (1)(a) – Consent of the data subject

6 (1)(b) –  Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract