Lawful basis

A lawful basis is the legal justification a data controller relies on to process personal data. Under Article 6(1) of the General Data Protection Regulation (GDPR), processing is lawful only if at least one of six bases applies: the data subject has consented, or the processing is necessary for a contract with the data subject, to meet a legal obligation, to protect someone’s vital interests, for a task in the public interest or under official authority, or for the legitimate interests of the controller or a third party, weighed against the data subject’s rights. Special category data, such as health data, also needs a condition under Article 9.

The lawful basis for processing is identified before collection and tied to a stated purpose, which connects it to purpose limitation. Consent is often mistaken for the default or strongest basis. It is one of six, it has to be freely given, specific, informed and unambiguous, and it can be withdrawn. Choosing the basis is the controller’s decision, not the data processor’s.

Exam relevance: a scenario may describe an organisation collecting personal data and ask what it needs first. Candidates are expected to know that consent is only one of the lawful bases, and that the controller settles the basis and the purpose before processing begins.