What Is a Lawful Basis? Six EU GDPR Routes Explained

A customer questionnaire asks for the lawful basis behind each use of personal data. The empty field can make the term sound like a code that a privacy specialist supplies. It is a practical decision instead: the controller identifies why it needs the information, then selects the legal ground that fits that purpose before the processing starts ¹.

Quick Answer. A lawful basis is one of six legal grounds in Article 6 EU GDPR: consent, contract, legal obligation, vital interests, public task or legitimate interests. Select it before processing, document why the purpose and necessity fit, complete any required balancing, and tell people which basis supports each use ^1,3.

Six routes, not six labels

EU GDPR (Regulation (EU) 2016/679) Article 6 provides six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Unlike current UK law, the EU regime has no seventh recognised-legitimate-interest basis that removes the balancing test for specified purposes. An EU controller relying on legitimate interests must still complete the ordinary three-part analysis ^1,3,4.

The table is a starting point, not a menu of convenient wording. “We have an interest in it” does not complete the legitimate-interests test. “Our contract mentions data” does not make every later use necessary for that contract. Each basis has boundaries that must match what actually happens.

Purpose comes before the answer

A useful assessment starts with a sentence that describes the purpose without legal vocabulary. “We use the address to deliver the order” is specific enough to test. “Customer administration” is not: it could hide delivery, marketing, fraud prevention and debt recovery, each of which may need separate analysis.

Necessity disciplines several bases. The controller asks whether the purpose can reasonably be achieved just as effectively through a less intrusive method. The Court of Justice has applied that test to legitimate interests and linked it to data minimisation ⁴. A useful system does not become necessary merely because the business has already bought it.

The basis should be settled before processing and connected to the stated purpose. Articles 13 and 14 require the privacy information to identify the lawful basis and, where Article 6(1)(f) applies, the legitimate interests pursued ¹. A documented assessment shows how the controller reached the answer instead of presenting a label after a complaint.

A single customer platform can support several purposes without having one blanket basis. Delivery details may be necessary for a contract. Proportionate fraud checks may rest on legitimate interests after a balancing assessment. Optional marketing needs its own GDPR basis and may also face channel-specific rules under the ePrivacy Directive as implemented in the relevant Member State. Separating purposes first keeps each legal test visible ^1,3,5.

Consent and legitimate interests are not synonyms

Consent is not a courtesy word for data collection. It is a basis with demanding conditions: the person needs a genuine and free choice, the request must be specific and informed, and an unambiguous affirmative action must express the decision. Consent can be withdrawn. Future processing that depended on it must stop after withdrawal, while processing completed beforehand remains lawful if the consent was valid at that time ^1,2.

Consent therefore fails where the controller would proceed regardless of the answer. An employer generally cannot describe essential payroll processing as optional consent. A seller cannot ask whether it may use the delivery address and still insist on using it after a refusal to fulfil an existing order. Contract or legal obligation may fit those purposes more honestly, depending on the facts.

Reliance on legitimate interests requires more than preference. The binding test comes from Article 6 and Court of Justice case law: identify a legitimate interest, prove the processing is strictly necessary for it, then balance that interest against the person's interests and fundamental rights and freedoms ^1,4. Guidelines 1/2024 are the EDPB's current version 1.0 adopted for public consultation, not a final text; they provide a structured explanation consistent with that three-part test ³. The record should describe the expected benefit, affected people, data used, likely impact, reasonable expectations and safeguards.

EU law has no recognised-legitimate-interest shortcut comparable to the separate UK route. Recital 47 notes that direct marketing may be a legitimate interest, but that recital does not decide an individual case. The controller still applies Article 6(1)(f), respects the absolute right to object to direct marketing under Article 21(2), and checks separate ePrivacy rules for the chosen channel ^1,3,5.

Public authorities face an additional boundary. Article 6(1)(f) is unavailable to public authorities when processing in the performance of their tasks. A public body must identify the public-interest or official-authority basis in Union or Member State law, or another Article 6 ground that genuinely applies; it cannot turn an official function into a private balancing exercise ¹.

Sensitive data needs another condition

Article 6 is only the first layer when information receives extra protection. Special-category data, such as health information, needs an Article 6 basis and a separate Article 9 condition. Personal data relating to criminal convictions and offences is governed by Article 10, which requires official-authority control or authorisation by Union or Member State law with appropriate safeguards ¹.

Those additional conditions do not replace the lawful basis. A health provider cannot record an Article 9 condition and leave the Article 6 field empty. Nor does ordinary consent automatically become the explicit-consent condition that Article 9 may require. The two questions should appear separately in the processing record.

The basis changes the rights around the processing

The lawful basis can affect which individual rights apply. The right to data portability, for example, applies to specified automated processing based on consent or contract. The right to object has particular relevance to public task and legitimate interests, while an objection to direct marketing must end processing for that purpose ¹. The choice therefore shapes how the controller answers a request later.

A basis does not remove the other GDPR principles. Personal data must still be processed fairly, transparently and for defined purposes; kept accurate and no longer than necessary; protected appropriately; and supported by evidence of accountability ¹. A technically available basis cannot rescue excessive collection or a misleading notice.

Turn the basis into a usable record

A small business does not need a legal essay for every activity. It does need enough evidence for another person to understand and repeat the decision. The record should connect the real purpose to the chosen basis, the necessity analysis and any supporting assessment.

The entry needs review when the purpose, data, people, technology or relationship changes. A genuinely new purpose may need a new basis. A later edit cannot turn earlier unlawful processing into lawful processing, so the useful control is a decision made before launch rather than a label repaired after a complaint.

The immediate task is modest: take one real processing activity, write its purpose in one sentence and test the six bases against the facts. Where consent appears to fit, verify that “no” is genuinely possible. For legitimate interests, complete all three parts and record the safeguards. Where sensitive or criminal-offence data is involved, identify the second legal condition separately.

Last updated: 26 August 2026.