The basic principle with respect to personal data is that Group employees may only capture, process and store such data if this is required for a specifically defined purpose and in the lawful perfor­ mance of their duties, or if there is another legal basis for this.