Why these two lists run everything
Session 1 settled whether the GDPR reaches you. This session answers the next question every leader asks: if it applies, what does it actually make us do? The honest answer is that the whole regulation is built on two foundations. Article 5 lists seven principles - the standing rules of the game. Article 6 lists six lawful bases - the permission slips, and you need one before you process any personal data. Get comfortable with these two lists and most of the GDPR stops feeling like a maze. The PDPA-trained instinct is to reach for consent every time; the GDPR quietly rewards you for reaching for the right basis instead.
The seven principles 9 min live
Article 5 sets out seven principles. Six describe how you must treat personal data. The seventh, accountability, changes everything: it is not enough to comply - you have to be able to show that you comply. That is the sentence a Singapore leader should underline.
LiveThe six handling principles, in plain English3 min▶
Read Article 5(1) once and it sounds like common sense. That is the point - the principles are the values, and every specific rule later in the GDPR is one of these six made concrete.
- Lawfulness, fairness, transparency (5(1)(a)). Have a lawful basis, do not use data in ways people would find unfair or surprising, and be honest about what you do.
- Purpose limitation (5(1)(b)). Collect data for a specified, stated purpose - and do not quietly repurpose it for something unrelated later.
- Data minimisation (5(1)(c)). Collect only what you actually need for that purpose. "Nice to have" is not a reason to hold it.
- Accuracy (5(1)(d)). Keep personal data correct and up to date; fix or erase what is wrong.
- Storage limitation (5(1)(e)). Do not keep data longer than you need it. Retention has to have an end.
- Integrity and confidentiality (5(1)(f)). Keep it secure - against loss, misuse, and unauthorised access.
LiveAccountability - the principle with teeth3 min▶
The seventh principle, in Article 5(2), is one sentence and it reshapes the other six: the controller "shall be responsible for, and be able to demonstrate compliance with" the principles. That last phrase is the whole game. It is not enough to be compliant - you must be able to prove it, on demand, to a regulator.
- Compliance becomes evidence. Records of processing, documented lawful bases, retention schedules, policies, and decision logs are how you demonstrate compliance. No evidence, no defence.
- The burden is on you. If a regulator asks why you held certain data or on what basis, the answer "we just did" is a finding against you. Accountability shifts the burden of proof onto the organisation.
- Why it matters for leaders. This is what turns privacy from a values statement into an operating discipline. The question you should ask your team is not "are we compliant?" but "could we show it tomorrow?"
Lumina's paper trail. Our running-case Singapore SaaS (fictional) had sensible data practices but almost nothing written down - the PDPA had never pushed it that far. The first thing being in GDPR scope forced was documentation: a record of what it processes, for what purpose, and on which lawful basis. Nothing about Lumina's behaviour was wrong; what was missing was the ability to demonstrate it.
Self-studyHow the principles echo, and extend, the PDPA2 min read▶
If you already run to the PDPA, most of Article 5 will feel familiar. The PDPA's Purpose Limitation, Notification, Accuracy, Protection, and Retention Limitation obligations map cleanly onto GDPR purpose limitation, transparency, accuracy, security, and storage limitation. The two regimes largely agree on what good handling looks like. Where the GDPR pulls ahead is accountability: the PDPA expects you to have policies and practices in place, but the GDPR makes the ability to demonstrate compliance an explicit, standalone principle with the burden squarely on you. Treat Article 5 as the PDPA data-protection provisions you know, plus a formal duty to keep the receipts.
The six lawful bases, and consent 9 min live
Before you process any personal data, you need a lawful basis. Article 6 gives you six, and here is the mindset shift for a PDPA-trained leader: they are co-equal doors, not a hierarchy with consent at the top. Consent is one door, and often the flimsiest one.
LiveThe six bases at a glance3 min▶
Article 6(1) lists six lawful bases. At least one must apply to your processing, and you should decide and record which one before you start - not reach for it afterwards.
| Basis (Art 6(1)) | When it fits | Typical use |
|---|---|---|
| (a) Consent | The person freely agrees to a specific use | Marketing emails, optional cookies |
| (b) Contract | You need the data to deliver what they signed up for | Fulfilling an order, running an account |
| (c) Legal obligation | A law requires the processing | Tax records, statutory reporting |
| (d) Vital interests | Someone's life is at stake | A medical emergency |
| (e) Public task | Official function in the public interest | Mostly public authorities |
| (f) Legitimate interests | Your genuine interest, not overridden by the person's rights | Fraud prevention, network security, some analytics |
The leadership point: for most everyday business processing, contract (b) or legitimate interests (f) is a better fit than consent. Consent should be reserved for the uses where the person truly has a real, free choice.
LiveWhat "consent" actually has to mean3 min▶
If you do use consent, the GDPR sets a high bar - much higher than the tick-box many companies grew up with. The definition (Article 4(11)) and the conditions (Article 7) together mean consent must be:
- Freely given - a real choice, not bundled into terms or a condition of service.
- Specific - tied to a particular purpose, not a blanket "we may use your data".
- Informed - the person knows who you are and what they are agreeing to.
- Unambiguous - a clear affirmative act. Pre-ticked boxes and silence do not count.
- Demonstrable and withdrawable (Art 7) - you must be able to show you obtained it, and it must be as easy to withdraw as it was to give. Withdrawal is not retroactive: it stops future processing but does not undo what was already lawful.
This is exactly why consent is often the wrong basis for core operations: if someone withdraws, you lose your basis. Contract or legitimate interests does not vanish that way.
Lumina picks a basis. Lumina had been treating its "I agree to the terms" checkbox as consent for everything. Rebuilding for the GDPR, it split its processing: running a customer's account is contract (Art 6(1)(b)), fraud and security monitoring is legitimate interests (Art 6(1)(f)) with a documented balancing test, and only its marketing emails stayed on consent (Art 6(1)(a)). Same activities, but now each has the basis that actually holds up - and the marketing consent is one someone can withdraw without breaking their account.
Self-studyLegitimate interests, and special-category data2 min read▶
Two nuances a leader should be able to name. First, legitimate interests (Art 6(1)(f)) is the only basis with a built-in "except where overridden by the individual's interests or rights" test. In practice you document that judgement as a balancing assessment - often called a legitimate interests assessment, or LIA. Worth flagging: LIA is the name the UK ICO and EDPB give the method, not wording that appears in the Regulation itself. The point for you is that this basis is not a free pass; you have to weigh your interest against the person's and be able to show your working.
Second, special-category data (Art 9) - health, race or ethnicity, political opinions, religious beliefs, trade-union membership, genetic and biometric data, sex life and sexual orientation - gets extra protection. Processing it is prohibited unless one of the specific conditions in Article 9(2) applies, such as explicit consent or an employment-law obligation. Crucially, an Article 9 condition is needed on top of an Article 6 basis, not instead of one. If your product touches health or biometric data, this is a board-level flag.
Map your purposes to a basis ★ 12 min · pen and paper
A lawful basis is decided per purpose, not per company. Do this for the way Lumina would - or for your own processing - and the shape of your compliance becomes clear.
List your main processing purposes in plain language: running accounts, billing, marketing, security monitoring, analytics, statutory records. One line each.
For each purpose, pick the single best-fitting basis from the six. Ask "why are we really doing this?" - the honest answer usually points to contract or legitimate interests, not consent.
Flag anything that touches special-category data (health, biometrics, and so on). Note that it needs an Article 9 condition on top of the Article 6 basis.
For any purpose left on consent, check it against the standard: freely given, specific, informed, unambiguous, and withdrawable. If it fails, ask whether a different basis fits better.
The "are we over-relying on consent?" audit ★ 8 min · your next privacy review
Companies coming from a PDPA background almost always lean on consent too hard. Four questions surface it fast.
"How many of our purposes sit on consent today?" If the honest answer is "nearly all of them", that is the PDPA reflex, not a GDPR design.
"For each consent-based purpose, does the person have a real, free choice?" If saying no would break the service they paid for, it is not free consent - it is probably contract.
"If a customer withdrew consent tomorrow, what would break?" Anything essential to the service should not have been on consent in the first place.
"Can we demonstrate the consent we hold, and let people withdraw as easily as they gave it?" Article 7 requires both. A one-way sign-up with no easy withdrawal fails.
Before session a3 ◐ 30 min total
- Finish mapping your top purposes to a lawful basis and mark which ones you would move off consent. Keep the list - a3 (rights) and a5 (breach) both lean on it.
- Identify whether any of your processing touches special-category data (Art 9). If it does, flag it for legal counsel before a3.
- Ask your team: could we demonstrate our lawful bases and our consents to a regulator this week, or would we be improvising?
- Optional: read GDPR Article 5 and Article 6 - between them they are under a page, and they are the spine of everything that follows.
- Do we have a documented lawful basis for each of our processing purposes, or are we defaulting to consent?
- Where are we relying on consent for something core to the service - and should it be contract or legitimate interests instead?
- For any legitimate-interests basis, have we done and recorded a balancing assessment?
- Does any of our processing involve special-category data (Art 9), and do we have a condition for it on top of an Art 6 basis?
- Could we demonstrate compliance with the Article 5 principles - records, retention, policies - if a regulator asked tomorrow?
Official sources covered
Taught from the GDPR text and reputable comparative guidance. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The GDPR's seventh principle, accountability (Art 5(2)), requires an organisation to...
Article 5(2) makes the controller responsible for, and able to demonstrate, compliance. The burden of proof sits with the organisation - records and evidence, not just good behaviour.
2 · Under GDPR Article 6, consent is...
The six bases are co-equal; you need at least one. Contract or legitimate interests usually fits everyday business processing better, and unlike consent it does not evaporate when a person withdraws.
3 · Processing special-category data (health, biometrics, beliefs) under Article 9 requires...
Special-category data is prohibited unless a specific Article 9(2) condition applies - and that condition is needed in addition to, not instead of, an Article 6 basis.