A legal basis is the lawful ground on which a controller relies to process personal data for a specific purpose. Under the GDPR, Article 6 lists six legal bases, and every processing operation must rest on at least one of them; processing without a valid basis is unlawful regardless of how secure or transparent it otherwise is.
In privacy practice, the legal basis is not a formality chosen after the fact. It determines which data subject rights apply, what must appear in the privacy notice, how long data may be kept and whether the person can stop the processing. Choosing it is therefore one of the first decisions in any data protection design.
The six legal bases in GDPR Article 6
The GDPR treats the six bases as equal in rank: none is preferred by law, and consent is not the default. The controller must select the basis that genuinely fits the purpose and the relationship with the individual.
The following table summarizes each basis, its core condition and typical processing that relies on it.
| Legal basis | Core condition | Typical use |
|---|---|---|
| Consent | Freely given, specific, informed, unambiguous agreement | Marketing emails, non-essential cookies |
| Contract | Necessary to perform or enter a contract with the person | Delivering an order, managing an account |
| Legal obligation | Required by EU or member state law | Tax records, anti-money laundering checks |
| Vital interests | Needed to protect someone’s life | Emergency medical treatment |
| Public task | Exercise of official authority or public interest task | Public administration, state schools |
| Legitimate interests | Controller interest not overridden by the person’s rights | Fraud prevention, network security |
Article 6 is only the first layer. Special category data such as health, biometric or religious information additionally requires one of the conditions in Article 9, and criminal offense data falls under Article 10. A controller processing health data therefore needs two separate justifications, not one.
How a controller selects the right basis
Selection starts with the purpose, not the data. The same email address may be processed under contract for order confirmations, under legal obligation for invoices and under consent for a newsletter. Each purpose is assessed separately and documented in the record of processing activities.
The key test for most bases is necessity. Processing is necessary only when the purpose cannot reasonably be achieved in a less intrusive way. Data that is merely useful to the business, such as profiling a customer for upselling, is not necessary for the contract even if the contract terms mention it.
The decision table below shows how common situations map to the most defensible basis.
| Situation | Recommended basis | Reason |
|---|---|---|
| Shipping a purchased product | Contract | Address is objectively needed to deliver |
| Keeping invoices for statutory periods | Legal obligation | Retention is imposed by accounting law |
| Analytics cookies on a website | Consent | ePrivacy rules require consent for storage access |
| Logging access to detect intrusions | Legitimate interests | Security interest outweighs low impact |
| Employee payroll | Contract and legal obligation | Employment contract and tax law both apply |
| Employee monitoring tools | Legitimate interests, rarely consent | Power imbalance makes consent unreliable |
The basis must be identified before processing begins and stated in the privacy notice. Regulators regard a retroactive change of basis as a sign that the original choice was not made in good faith.
Consequences of the chosen basis for data subject rights
The legal basis directly shapes which rights an individual can exercise. This is why swapping one basis for another is never a neutral decision: it changes the person’s control over the data.
| Legal basis | Right to object | Data portability | Erasure on request |
|---|---|---|---|
| Consent | Not applicable, consent can be withdrawn | Yes | Yes, after withdrawal |
| Contract | No | Yes | Yes, once no longer needed |
| Legal obligation | No | No | No, while the law requires retention |
| Public task | Yes | No | Limited |
| Legitimate interests | Yes | No | Yes, if objection succeeds |
For direct marketing, an objection under legitimate interests is absolute: the controller must stop without weighing interests. For consent, withdrawal must be as easy as giving it, and processing carried out before withdrawal remains lawful.
Legal basis compared with related GDPR concepts
The legal basis answers whether processing is permitted; neighboring concepts in the GDPR answer different questions. Confusing them is a frequent source of compliance gaps.
| Concept | Question it answers | Relation to legal basis |
|---|---|---|
| Legitimate interest | Does the controller’s interest outweigh the person’s? | One of the six bases, tested by a three-part assessment |
| Purpose limitation | May data be reused for a new purpose? | New purposes need compatibility or a new basis |
| DPIA | Is the risk to individuals acceptable? | Assesses risk, does not replace a basis |
| Data protection officer | Who advises and monitors compliance? | Reviews basis choices, does not grant them |
A completed DPIA does not make processing lawful on its own, and a privacy notice does not create a basis either. Transparency describes the basis; it cannot substitute for one.
Common mistakes when relying on a legal basis
Most enforcement findings about legal bases involve a mismatch between the stated basis and reality. The recurring patterns are well known to supervisory authorities.
- Defaulting to consent where the person has no real choice, for example in employment or when access to a service depends on it.
- Stretching contract necessity to cover behavioral advertising or personalization that the service does not require.
- Switching to legitimate interests after consent is refused or withdrawn, which regulators treat as unfair.
- Bundling purposes under one basis instead of assessing each purpose separately.
- Skipping the balancing test for legitimate interests or failing to document it.
The remedy in each case is the same: document the purpose, the basis and the reasoning at the time of design, review it when the processing changes, and make sure the privacy notice and internal records tell the same story.
In simple terms
A legal basis is the reason the law accepts for using someone’s personal information. Before an organization collects or uses your data, it has to point to one of six approved reasons, such as needing the data to deliver what you bought or having your permission.
Think of it like a ticket at a concert gate. Without the right ticket, you are not allowed in, no matter how politely you behave inside. In the same way, without a valid legal basis, using personal data is not allowed, even if the data is kept perfectly safe. The type of ticket also matters, because it decides what you can later ask the organization to do with your data.
A practical example
An online bookstore reviews its processing before launching a loyalty program. It maps four purposes: delivering orders, storing invoices for ten years under tax law, sending a monthly newsletter and analyzing purchase history to recommend books.
Delivery is assigned to contract, invoices to legal obligation and the newsletter to consent collected through an unticked checkbox. For recommendations, the team runs a balancing test, concludes that customers reasonably expect suggestions based on their own purchases, and selects legitimate interests with a clear opt-out link in every recommendation email.
The result is a privacy notice that lists each purpose with its basis and the rights that follow. When a customer later objects to recommendations, the store stops that processing within days while continuing to keep the invoices lawfully, because the tax obligation is a separate basis that the objection does not affect.