TL;DR: Processing personal data under GDPR requires a valid lawful basis. The six bases include consent, contract, legal obligation, vital interests, public task, and legitimate interests, each suited for different scenarios. Sensitive data needs extra safeguards, and choosing the right basis ensures compliance and protects individual rights.
A lawful basis, also known as a legal basis, is the legitimate justification for performing an action, particularly in legal or regulatory contexts. It ensures that decisions and activities aren’t arbitrary but grounded in a recognized reason. Under GDPR, a lawful basis is required to process personal data, providing clarity, accountability, and predictability for both organizations and individuals. It also prevents actions from being challenged as unlawful or unauthorized.
Under GDPR Article 6, you cannot process personal data unless you have a valid lawful basis. The six lawful bases are:
Consent
The individual has given clear, unambiguous consent for their data to be processed for one or more specific purposes. Consent must be freely given, and individuals can withdraw it at any time without penalty. Each purpose requires separate consent if data is used for multiple purposes.
An example of consent is when a user visits a website and clicks “Accept” on a cookie banner to allow tracking for analytics and marketing.
Contract
The processing is necessary to fulfill a contract between the data subject and the data controller or to take steps to prepare for entering into a contract. To provide the promised service to a customer, this processing of personal data is required.
An example of a contract as a legal basis is when an online retailer processes a customer’s name, address, and payment details to deliver a purchased product.
Legal obligation
The legal obligation lawful basis under GDPR means an organization can process personal data if it is required by law. There may be circumstances where you are legally obliged to conduct certain activities, which will involve processing personal data. This could be to comply with common law or to undertake a statutory obligation.
An example of a legal obligation is if a job candidate is required by law to have a visa to be hired. You must then process certain personal identification and other documentation to ensure they are allowed to work for you. This is a legal obligation to process.
Vital interests
Processing may be necessary to protect someone’s life or prevent serious harm. This basis is typically used in emergency or medical situations.
An example of vital interests is if a coworker collapses in a workplace and is unconscious. When paramedics arrive, it may be necessary, for life-saving purposes, for HR to disclose known health information.
Public task
Processing personal data is lawful when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
An example of a public task is a private or public water company that processes personal information to provide its services. This is because they perform public administration functions and use special legal powers to deliver utility services in the public interest.
Legitimate interest
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. This basis should be used carefully, especially when the data subject is a child.
An example of legitimate interest is a company analyzing customer data to improve services or prevent fraud, so long as it does not unfairly impact individuals.
Special Category Data Requires Additional Conditions Under Article 9
Special category data under Article 9 of the GDPR refers to highly sensitive personal information that requires extra protection, such as health records, racial or ethnic origin, political opinions, or sexual orientation. Processing this type of data is generally prohibited unless specific exceptions apply.
What is special category data under Article 9?
Before exploring the exemptions, it is important to understand what qualifies as special category data. According to Article 9(1), this includes:
- Racial or ethnic origin.
- Political opinions.
- Religious or philosophical beliefs.
- Trade union membership.
- Genetic or biometric data for uniquely identifying a person.
- Health data.
- Sex life or sexual orientation.
This type of data is considered highly sensitive because, if misused or exposed, it may lead to discrimination, social harm, or personal risks for individuals. As a result, stricter safeguards apply compared to regular personal data.
Conclusion
A lawful basis is essential because it provides legal justification for processing personal data under GDPR. Without it, any processing would be unlawful and could be challenged. It ensures organizations act with clarity, accountability, and fairness. Each of the six lawful bases such as consent, contract, legal obligation, vital interests, public task, and legitimate interests applies to different situations. In short, a lawful basis protects individuals’ rights while allowing organizations to process data responsibly.
Want a simple way to get documents signed? Try a free BoldSign trial and explore our complete e-signature platform.
Need help? Schedule a demo or contact our support team via our support portal.
