The new requirement to have a lawful basis to process personal data replaces and mirrors the previous requirement to satisfy one of the ‘conditions for processing’ under the Data Protection Act 1998. However, the GDPR places more emphasis on being accountable for and transparent about a lawful basis for processing. We must have a valid lawful basis to process personal data. There are six available lawful bases for processing. We have identified ‘legitimate interests’ as our lawful basis for processing personal information. We take on the extra responsibility for considering and protecting people’s rights and interests here.

Our Legitimate Interests are:

1. To establish overall fitness scores for individual children – to inform and engage stakeholders, and to track fitness and health progress

2. To provide badges for children to work towards – to celebrate their achievements, and as a motivational tool

3. To provide individual and year group information to the school or organisation – which can be used for report writing and future planning

4. To establish a developing national picture for childrens’ physical fitness and health – imperative for future planning on a larger scale

We cannot reasonably achieve these outcomes in a less intrusive way. We have balanced our interests against the individual’s when taking the decision to process this information. We will process all personal data lawfully, fairly and in a transparent manner.