Legal basis

A business may not process personal data merely because doing so appears useful. Each purpose and processing activity needs an appropriate legal basis. Article 6(1) GDPR lists six possibilities: consent, a contract or pre-contractual steps requested by the data subject, a legal obligation, protection of vital interests, a task carried out in the public interest or in the exercise of official authority, and legitimate interests subject to a balancing assessment.

The legal basis depends on the actual purpose and operation. Consent is reliable only if it is freely given, informed and unambiguous, and if the business can demonstrate it for the relevant processing. Contract necessity cannot be equated with every commercial benefit. For legitimate interests, the business should identify its own or a third party’s interest, assess necessity, weigh the impact on the data subject and consider the data subject’s reasonable expectations. Processing special categories of personal data additionally requires an applicable condition under Article 9(2) GDPR.

The chosen legal basis should be settled before processing starts and must match the information provided to data subjects. If the purpose, data set or processing context changes, the assessment must be revisited. The same applies to data flows involving service providers, direct marketing and new software. A documented legal basis is therefore not a substitute for monitoring the processing as it actually takes place.

In practice, record the purpose, data categories, data-subject groups, processing steps and corresponding legal basis together. The privacy compliance and governance section places this documentation in its organisational context. For marketing, cookies and tracking, also review the specific consent and balancing framework.