Lawful basis for processing

What it means

A lawful basis for processing is one of the six grounds under the GDPR that permit processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. Processing without a lawful basis is unlawful even if it is otherwise secure.

Each purpose must have exactly one suitable lawful basis, chosen in advance. Invoicing rests on a legal obligation, delivering ordered goods on the contract, a newsletter often on consent, and CCTV to protect property on legitimate interest.

Consent is not the best basis for everything. It must be freely given and can be withdrawn at any time, so it is unsuitable for processing the company needs regardless of the person's wishes, such as accounting or payroll. Those rely on legal obligation or contract.

How it works in practice

The list of purposes and lawful bases belongs in the record of processing activities and in the information given to data subjects. When fulfilling the duty to inform, the company must state the basis on which it processes data and, for legitimate interest, what that interest is.

Legitimate interest requires a balancing test: what the company's interest is, whether processing is necessary and whether the person's rights override it. The outcome is documented so it can be shown to the authority. Data subjects have the right to object to such processing.

The lawful basis also determines the scope of data and retention. Under the data minimisation principle, only data needed for the purpose are collected and they are deleted once it is fulfilled, unless the law requires longer retention, as with accounting documents.

What to watch out for

Switching the lawful basis after the fact is problematic. If a company processed data on the basis of consent and the person withdraws it, it cannot simply move to legitimate interest. Choosing the right basis from the start and communicating it clearly is therefore essential.

For special categories such as health data, an ordinary lawful basis is not enough; one of the GDPR exceptions must also apply. Data on criminal offences are subject to even stricter rules that an ordinary business often cannot meet.