Fact · Voice privacy and security
Under the EU GDPR, processing personal data is lawful only if and to the extent that at least one of the listed conditions applies, and consent is one of them.
Checked against its source on October 17, 2026
In the source's own words
“Processing shall be lawful only if and to the extent that at least one of the following applies”
Regulation (EU) 2016/679 (General Data Protection Regulation), recitals, Official Journal of the European Union (EUR-Lex), 2016, Article 6(1).
Open the original- What it measures
- Article 6(1) lists six lawful bases, starting with consent of the data subject in point (a). A recording that identifies a person is personal data, so the same test applies to it.
- What it does not show
- The article sets the general test. Member states and the UK have their own rules on specific recording contexts, and this text does not cover them.