Ask any privacy professional to name current buzzwords in the data protection world and you can be sure that “adtech” will be high on the list. It is a key area of focus for the Information Commissioner’s Office (ICO), with online tracking identified as a priority area in its 2018-2021 technology strategy.

The ICO also commenced an investigation into adtech and real-time bidding (RTB) in February 2019. The regulator identified several key areas of interest in the investigation, one of which was the lawful basis for processing personal data in adtech.

Identifying the lawful basis for processing is a vital part of demonstrating compliance with the General Data Protection Regulation (GDPR). It is not always a straightforward task and is further complicated in the adtech context by the interplay between the GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). In this article, we look at the key considerations for adtech businesses, and brands looking to take advantage of the capabilities of adtech, in determining the lawful basis for processing.