§ 23 LDSG SH
Lawfulness of the processing of personal data
(1)The processing of personal data shall be lawful where it is necessary for the performance of a task within the competence of the controller or in the exercise of official authority vested in the controller.
(2)The purpose of the processing of personal data shall also include processing for the exercise of supervisory and control powers, for auditing purposes, for conducting organisational reviews, and for the testing and maintenance of automated procedures. This shall also apply to the processing of personal data for training and continuing education purposes, provided that the legitimate interests of the data subject are not adversely affected. The processing of data for testing and examination purposes shall not be covered thereby. zur Einzelansicht § 23