Explain the reasons for the legitimacy of personal data processing from the perspective of EU and Iranian law

With the adoption of the European Union General Data Protection Regulation (GDPR) on personal data protection in 2016 and its entry into force in 2018, all EU member states were required to provide maximum protection of personal data and individuals. The maximum protections of this regulation are expressed in various provisions, which are more accurate, stricter and more practical than the previous legal frameworks of the European Union and other countries. In order to fully realize such protection, this regulation has stated several reasons for the legitimacy of personal data processing under the title of legal bases of personal data processing. According to the relevant article, controllers must have a valid legal basis for processing personal data. By explaining the aforementioned legal bases, the current research seeks to verify the feasibility of these legal bases in Iranian law. In other words, the answer to the question that in Iran's legal system, personal data can be processed despite the existence of which reasons. The result of the investigations is that the flow of the legal bases mentioned in the European data protection regulation - consent, contractual necessity, processing under the legal obligation of the controller, protection of the vital interests of individuals and the legitimate interests of the controller or a third party if prevailing - Due to the lack of Iranian law regarding the protection of personal data, it should be checked through different sources of Iranian law. Also, the results indicate that the aforementioned legal bases can also be used in Iranian law; But its full realization is achieved by the law.