Under the General Data Protection Regulation, a bank can process personal data if the processing is:

• A. incidental to the service provided by the bank to the customer.
• B. not necessary for the performance of a contract between the bank and the consumer.
• C. overseen by a senior manager of the bank.
• D. necessary in order to protect the vital interests of the data subject or of another natural person.

Answer: (D)

Under GDPR, you may process personal data only if there is a lawful basis for doing so. One such basis is that processing is necessary to protect the vital interests of the data subject or of another natural person. This is a narrow, emergency-driven exception used when someone’s life or health could be at risk and the data subject cannot give consent in time. In a banking context, this might apply in urgent situations where sharing certain information is essential to prevent harm or respond to a medical emergency.

This option is the best fit because it directly matches the required basis: a real, essential risk to life or health that justifies processing without consent. The other ideas don’t provide a valid lawful basis on their own—processing that’s merely incidental to services isn’t a standalone basis; processing not necessary for a contract isn’t automatically allowed unless another basis applies; and having oversight by a senior manager doesn’t create a legal basis for data processing.