Lawful Basis

Under the General Data Protection Regulation, the European Union's data-protection law, you cannot use someone's personal data just because it is useful. Processing personal data is only lawful if you can point to a lawful basis — one of six legal grounds set out in Article 6. The six are consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent means the person clearly agreed. Contract means the processing is necessary to deliver something they asked for. Legal obligation means a law requires it. Vital interests covers life-or-death situations. Public task covers official functions in the public interest. Legitimate interests covers a genuine need that does not override the person's rights. Before an organization collects or uses personal data, it has to decide which of these applies — and at least one must, or the processing is unlawful. This is not paperwork after the fact; it is the precondition for touching the data at all.

The bases are not ranked, and they are not interchangeable. No single ground is 'best'; the right one depends on what you are actually doing and why. Sending a parcel someone ordered rests on contract, not consent. Reporting payroll to the tax authority rests on legal obligation. Running fraud checks might rest on legitimate interests. Emailing marketing to a cold list generally needs consent. Crucially, you must choose the basis before you start processing and, in most cases, stick with it — you cannot quietly switch to a different ground when your first choice becomes inconvenient. Consent, in particular, comes with strings: it must be freely given, specific, informed, and as easy to withdraw as to give. Because the basis you pick determines the rights the person has and the obligations you carry, naming it correctly at the outset is the whole discipline.

The single most common mistake is treating 'lawful basis' and 'consent' as the same thing. Consent is only one of the six bases, and often not the right one. Many organizations reflexively ask for consent for everything, which is both unnecessary and risky. Unnecessary, because if you are processing data to fulfill a contract the person entered, or to meet a legal duty, consent is not the appropriate ground and asking for it muddies the picture. Risky, because consent under the regulation is a high bar — freely given, specific, informed, unambiguous, and revocable at any time — so if you rely on consent and the person withdraws it, you must stop. A basis like contract or legitimate interests does not evaporate the moment someone changes their mind. Reaching for consent by default, rather than the basis that actually fits, creates fragile, over-engineered compliance.

So the discipline is to match the basis to the processing, not to habit. If the processing is genuinely necessary to provide a service the person asked for, the basis is contract. If a law compels it, the basis is legal obligation. If it serves a real business interest and does not override the person's rights and freedoms, legitimate interests may fit — but that basis requires you to weigh your interest against theirs and be able to show your working. Consent is the right basis when none of the others apply and you are asking the person to opt in to something they can freely refuse, such as marketing. Each basis carries different downstream rights: the right to erasure and the right to portability, for instance, apply differently depending on which ground you relied on. Picking the wrong basis does not just misfile the decision; it changes what the person is owed.

Choosing a lawful basis well means deciding it up front, documenting it, and telling people. Before a new processing activity starts, work out what you are doing and why, then select the single most appropriate ground from the six — not the most convenient. Record that decision, because accountability is itself a regulatory requirement, and set it out in your privacy notice so the people whose data you use know the basis you rely on. Where you lean on legitimate interests, carry out and keep a balancing assessment showing your interest does not override their rights. Where you rely on consent, capture it properly and make withdrawing it as easy as giving it. Review the basis if the processing changes, since a new purpose may need a new ground. None of this is legal advice — real programs should involve a data-protection specialist — but the shape of good practice is consistent: right basis, chosen first, written down, disclosed.

The failures are predictable. Defaulting to consent for everything, then being unable to keep processing when someone withdraws it. Choosing a basis to suit convenience rather than the actual purpose, so it will not hold up under scrutiny. Failing to document the decision or to name it in the privacy notice, breaching the accountability and transparency duties even if the basis itself was sound. Relying on legitimate interests without doing the balancing test, so there is no evidence the person's rights were weighed. And switching bases mid-stream when the first one becomes awkward, which the regulation does not allow in most cases. The discipline is to treat the lawful basis as a decision made before processing begins, matched honestly to the purpose, documented, disclosed, and revisited only when the purpose genuinely changes — and to get specialist advice rather than guess, because the wrong basis can invalidate the whole activity.

The phrase joins 'lawful' (from Old English lagu, 'law') with 'basis' (Greek basis, 'foundation'), naming the legal foundation that GDPR Article 6 requires before personal data may be processed.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where lawful basis is a core concern: