Legal Bases for Processing Personal Data
Article 6(1) of the GDPR provides six lawful bases for processing personal data. At least one of these must apply whenever you process personal data.
The Six Legal Bases
1. Consent (Article 6(1)(a))
- The individual has given clear consent for you to process their personal data for a specific purpose
- Must be freely given, specific, informed and unambiguous
- Easily withdrawn
2. Contract (Article 6(1)(b))
- Processing is necessary for a contract you have with the individual
- Or because they have asked you to take specific steps before entering into a contract
3. Legal Obligation (Article 6(1)(c))
- Processing is necessary for you to comply with the law (not including contractual obligations)
- The obligation must be in EU or Member State law
4. Vital Interests (Article 6(1)(d))
- Processing is necessary to protect someone's life
- Should be used only in situations of genuine emergency
5. Public Task (Article 6(1)(e))
- Processing is necessary for you to perform a task in the public interest
- Or for your official functions, and the task or function has a clear basis in law
6. Legitimate Interests (Article 6(1)(f))
- Processing is necessary for your legitimate interests or the legitimate interests of a third party
- Unless there is a good reason to protect the individual's personal data which overrides those legitimate interests
- Cannot be used by public authorities performing their tasks
Choosing the Right Legal Basis
You must determine your legal basis before you begin processing. Consider:
- Your purpose and reason for processing
- The relationship between you and the individual
- Whether there is a power imbalance
- What individuals would reasonably expect
- The nature and risks of the processing
Documenting Your Legal Basis
You must:
- Document your legal basis for processing in your privacy notice
- Include it in your records of processing activities
- Be able to explain and justify your choice
Changing Legal Basis
You should not change your legal basis once you have started processing unless there is a genuine reason and you can demonstrate that the new legal basis is equally appropriate. You must inform individuals if you change your legal basis.
Special Category Data
If you are processing special category data, you need to identify both a legal basis under Article 6 and a separate condition for processing under Article 9.