What legal basis do you use for processing personally identifiable data under GDPR?

Read time:: 1 min
Published:: 17/08/2026
Group:: GDPR/Data Protection and Information Security

GDPR regulations set out six lawful bases under which a business can use personal data legally as part of their business activities. At least one of these must apply whenever you process personal data. The lawful basis we use for this processing is "Legitimate Interest" in accordance with recital 47 of the GDPR.

The ICO recommend that companies using this basis conduct a "Legitimate Interests Assessment" (LIA) and we have done this. The Telemarketing Company complies in full with the TPS/CTPS to prevent unwanted sales and marketing calls and maintains its own company “Do not Call list” in line with Ofcom regulations.

Related FAQs

How do you ensure data isn't corrupted, lost or stolen?

The Telemarketing Company holds the ISO 27001 Information Security Management accreditation. ISO 27001 certifies that a business has a systematic and ongoing approach to managing information security risks that affect the confidentiality, integrity, and availability of company and customer information. This accreditati

Find out more

How do you work with personally identifiable data?

As a telemarketing agency, we work on our own behalf and on behalf of various clients, contacting existing and prospective B2B and B2C customers using the phone and other channels. As this involves the processing of personally identifiable data, it is vital that we comply with the GDPR, and are committed to the secure

Find out more

Is cold calling still possible under GDPR?

Yes, it is. GDPR legislation does allow businesses to cold call but ensures it is done in a responsible way, only where there is a ‘Legitimate interest’ to do so, and where the interests, rights and freedoms of the individual are protected. Under GDPR, organisations are entitled to process personal data to carry out th

Find out more

What processes do you apply to protect the rights of individuals?

As part of our best practice framework and GDPR compliance, we have processes in place to avoid any negative impact on call recipients including:

Find out more

Where does the data come from?

The data we process is obtained from several sources. These include information requests via our website or other channels, our clients, GDPR compliant data providers and online resources in the public domain.

Find out more