Member

Currently, the extra step is required to be taken only when there may be a higher risk, such as those wishing to process sensitive data using the research condition under Schedule 1 to the Data Protection Act 2018. I can assure the Committee that even if research is scientific, that is not enough. Controllers would still need to find a lawful basis and perform the balancing tests to see whether it was a legitimate interest.