Every time personal data is collected, stored or used, there must be a lawful basis for processing it under the UK GDPR.
Choosing the appropriate lawful basis before processing begins helps organisations process personal data lawfully, meet their UK GDPR obligations and provide individuals with clear information about how their personal data will be used.
This guide explains the six lawful bases for processing data and includes a practical decision guide to help you determine which lawful basis applies to your processing activities.
What does processing data lawfully mean?
Every processing activity must have at least one lawful basis before personal data is processed. Organisations must be able to explain and justify why a chosen lawful basis applies if it is questioned by the Information Commissioner’s Office (ICO) or the individual concerned.
A lawful basis for processing personal data is the legal justification for collecting, using, storing or sharing personal data under the UK GDPR.
What are the 6 lawful bases for processing data?
Under UK GDPR, Article 6, every processing activity must rely on at least one of these lawful bases before personal data is collected or used.
UK GDPR 6 lawful bases are:
Consent
Consent applies when an individual gives clear permission for their personal data to be processed for a specific purpose. Under the UK GDPR, consent must be freely given, specific, informed and unambiguous, and individuals must be able to withdraw their consent as easily as they gave it.
Use this basis when:
- Individuals have a genuine choice about whether their personal data is processed.
- Processing is optional rather than essential.
- You are carrying out activities such as sending marketing emails, newsletters or placing non-essential cookies.
What to consider:
- Explain clearly what personal data will be processed, why it is needed and how it will be used.
- Keep consent requests separate from terms and conditions or other agreements.
- Use an active opt-in, such as ticking an empty box. Pre-ticked boxes, silence or inactivity do not constitute valid consent.
- Make withdrawing consent as simple as giving it.
- Consider whether another lawful basis is more appropriate. If processing is necessary to fulfil a contract or comply with a legal obligation, consent is unlikely to be the correct basis.
Example:
A customer actively signs up to receive promotional emails. If they later unsubscribe, their personal data should no longer be processed for that marketing purpose unless another lawful basis applies.
Contract
The Contract basis applies where processing personal data is necessary to fulfil a contract with an individual or to take steps at their request before entering into a contract.
Use this basis when:
- Personal data is essential to provide a product or service.
- An individual has requested information or action before entering into a contract, such as requesting a quotation or applying for a job.
- Processing is directly related to delivering what has been agreed.
What to consider:
- Ask whether the contract could still be fulfilled without processing the personal data. If the answer is yes, another lawful basis may be more appropriate.
- Only collect the personal data needed to fulfil the contract.
- Do not use this basis simply because processing is useful or convenient for your organisation.
- Separate any additional processing, such as marketing or customer profiling, and identify the appropriate lawful basis for those activities.
Example:
An online retailer processes a customer’s name, address and payment details to fulfil an order.
Legal Obligation
Legal Obligation applies where processing personal data is required to comply with a legal duty. The obligation must arise from legislation or another legal requirement rather than an internal policy or contractual agreement.
Use this basis when:
- Legislation requires you to collect, retain or disclose personal data.
- You must provide information to a regulator or government body.
- Records must be maintained to comply with employment, tax or health and safety legislation.
What to consider:
- Identify the specific legislation or legal requirement that requires the processing.
- Keep records only for as long as the legal obligation applies.
- Do not rely on this basis simply because processing is required by an internal policy or customer contract.
- Ensure you can demonstrate why the processing is legally required if requested by a regulator.
Example:
An employer processes payroll information and submits employee earnings to HMRC to comply with tax legislation.
Vital Interests
Vital Interests applies where processing personal data is necessary to protect someone’s life or prevent serious harm. This lawful basis has a very limited scope and is generally only appropriate in genuine emergencies.
Use this basis when:
- Processing is necessary to protect someone’s life.
- An individual is physically or legally incapable of giving consent.
- There is no more appropriate lawful basis available.
What to consider:
- Do not use this basis for routine business activities or general health and safety management.
- Consider whether another lawful basis, such as Legal Obligation or Contract, is more appropriate before relying on Vital Interests.
- Limit the processing to the information needed to deal with the emergency.
- Record why this lawful basis was necessary if circumstances allow.
Example:
Emergency services are given details of an employee’s severe allergy after a serious workplace incident to support urgent medical treatment.
Public Task
Public Task applies where processing is necessary to carry out a task in the public interest or exercise official authority. The task or authority must have a clear basis in UK law.
Use this basis when:
- You are a public authority carrying out your statutory functions.
- You are exercising official powers given by legislation.
- A private organisation has been given legal authority to carry out a specific public function.
What to consider:
- Public benefit alone does not mean this lawful basis applies.
- Be able to identify the legislation or statutory power that authorises the processing.
- Most private sector organisations will not rely on Public Task.
- If you are carrying out commercial activities rather than public functions, another lawful basis is likely to be more appropriate.
Example:
A local authority processes residents’ personal data to administer council tax or provide social care services.
Legitimate Interests
Legitimate Interests applies where processing personal data is necessary for your organisation’s legitimate interests, or those of a third party, provided those interests are not overridden by the rights and freedoms of the individual.
This is one of the most flexible lawful bases under the UK GDPR, but it should not be treated as a default option.
Use this basis when:
- Processing supports a legitimate business purpose.
- The processing is necessary to achieve that purpose.
- Individuals would reasonably expect the processing to take place.
- The impact on individuals’ privacy is limited and proportionate.
What to consider:
- Complete a Legitimate Interests Assessment (LIA) to demonstrate why this lawful basis is appropriate (see ‘When do you need a Legitimate Interests Assessment (LIA)?’ below).
- Consider whether individuals are likely to expect the processing.
- Balance your organisation’s interests against the individual’s rights and freedoms.
- If the same objective can reasonably be achieved in a less intrusive way, Legitimate Interests may not be appropriate.
- Remember that individuals have the right to object to processing carried out under this lawful basis in certain circumstances.
Example:
An organisation monitors network activity to detect cyber security threats or processes personal data to investigate suspected fraud.
Which lawful basis for processing personal data applies? A quick decision guide
Answer the following questions in order. As soon as you answer Yes, you have probably identified the most appropriate lawful basis for your processing activity.
1. Are you required by law to collect, keep or share the personal data?
For example, to comply with employment law, tax legislation or another statutory requirement.
- Yes → Legal Obligation is likely to be the appropriate lawful basis.
- No → Continue to Question 2.
2. Is processing the personal data essential to provide a product or service, or to take steps before entering into a contract?
For example, processing an online order, arranging a delivery or preparing an employment contract.
- Yes → Contract is likely to be the appropriate lawful basis.
- No → Continue to Question 3.
3. Has the individual freely agreed to the processing?
For example, signing up to receive marketing emails or consenting to non-essential cookies.
- Yes → Consent is likely to be the appropriate lawful basis.
- No → Continue to Question 4.
4. Is processing necessary to protect someone’s life or prevent serious harm?
This lawful basis is intended for genuine emergencies where there is no more appropriate alternative.
- Yes → Vital Interests is likely to be the appropriate lawful basis.
- No → Continue to Question 5.
5. Are you carrying out an official function or task set out in law?
This usually applies to public authorities or organisations exercising official powers.
- Yes → Public Task is likely to be the appropriate lawful basis.
- No → Continue to Question 6.
6. Is processing necessary for a legitimate business purpose that does not override the individual’s rights and freedoms?
For example, preventing fraud, maintaining network security or carrying out limited internal administration where individuals would reasonably expect the processing.
- Yes → Legitimate Interests may be the appropriate lawful basis. Complete a Legitimate Interests Assessment (LIA) before relying on this basis.
- No → Review whether you have a lawful basis for processing the personal data. If none of the six lawful bases apply, you should not begin processing.
Before you decide
Before relying on any lawful basis, ask yourself these final questions:
- Does this lawful basis genuinely reflect why the personal data is being processed?
- Can you explain and justify why it applies?
- Have you documented your decision before processing begins?
- Does your privacy information accurately reflect your chosen lawful basis?
Why is choosing the correct lawful basis for processing data important?
Identifying the correct lawful basis before processing begins helps you to:
Comply with the UK GDPR
Article 6 of the UK GDPR requires every processing activity to have a lawful basis. If no lawful basis applies, the processing is unlawful and may breach the first data protection principle.
Provide accurate privacy information
UK GDPR, Article 13 and Article 14 require organisations to tell individuals why their personal data is being processed and the lawful basis they are relying on. Choosing the wrong lawful basis can result in inaccurate privacy information, making it difficult for individuals to understand how their data is being used.
Support individuals’ rights
The lawful basis you choose affects the rights available to individuals. For example, someone can withdraw consent at any time if you rely on Consent, whereas different rights may apply if you rely on Legal Obligation or Contract. Choosing the correct lawful basis ensures individuals can exercise the rights available to them.
Reduce compliance risks
Your lawful basis should be identified before processing begins. If you later discover that you have chosen the wrong lawful basis, you cannot simply change it because another basis appears more appropriate.
The lawful basis forms part of the information provided to individuals when their personal data is collected, so identifying the correct basis from the outset helps reduce the risk of complaints, regulatory scrutiny and enforcement action.
Build trust
Being transparent about why personal data is collected and how it will be used helps build confidence among employees, customers and other stakeholders. Organisations that clearly explain their lawful basis and only process the personal data they genuinely need are more likely to demonstrate responsible data handling and maintain trust.
What is a Legitimate Interests Assessment (LIA)?
If you decide that Legitimate Interests is the most appropriate lawful basis for processing personal data, you should complete a Legitimate Interests Assessment (LIA) before processing begins.
A Legitimate Interest Assessment is a process that helps you determine whether Legitimate Interests is the correct lawful basis. It also provides evidence that you have carefully considered the impact of the processing on individuals and can justify your decision if it is ever questioned by the Information Commissioner’s Office (ICO) or the individual concerned.
A Legitimate Interests Assessment considers three key questions:
Purpose test
What legitimate interest are you trying to achieve?
Clearly define the reason for processing the personal data and the business objective it supports. For example, you may be processing personal data to prevent fraud, maintain network security or improve the delivery of your services.
Necessity test
Is processing personal data necessary to achieve that purpose?
Consider whether the same objective could reasonably be achieved without processing personal data, or by processing less personal data. If a less intrusive approach is available, Legitimate Interests is unlikely to be the most appropriate lawful basis.
Balancing test
Do your organisation’s interests outweigh the impact on the individual?
Consider what personal data is being processed, what individuals would reasonably expect, the potential impact on their privacy and whether appropriate safeguards are in place. If the processing is likely to have an unjustified impact on individuals or override their rights and freedoms, Legitimate Interests is unlikely to apply.
Documenting the outcome of the assessment provides a clear record of why Legitimate Interests was chosen and demonstrates that your organisation has taken a considered and proportionate approach to processing personal data.
Documenting your lawful basis for processing personal data
The UK GDPR’s accountability principle (Article 5(2)) requires organisations to be able to demonstrate compliance. Organisations should document:
- The processing activity
Describe what personal data is being processed and the activity it relates to, such as processing employee payroll, delivering customer orders or sending marketing emails. - The purpose of the processing
Explain why the personal data is being processed. The purpose should be clear, specific and consistent with the information provided in your privacy notice. - The lawful basis relied upon
Record which of the six lawful bases applies to the processing activity before processing begins. - Why that lawful basis applies
Briefly explain why the processing meets the requirements of the chosen lawful basis. This provides evidence of the reasoning behind your decision if it is ever questioned. - Any supporting assessments
Keep copies of any documents that support your decision, such as a Legitimate Interests Assessment (LIA), Data Protection Impact Assessment (DPIA) or other relevant records.
Maintaining clear records helps demonstrate compliance with the UK GDPR, supports consistent decision-making across your organisation and makes it easier to respond to enquiries from regulators or individuals.
Apply the UK GDPR with confidence
Understanding the lawful basis for processing data is essential for complying with the UK GDPR.
Our UK GDPR Training and Awareness course gives employees the knowledge and confidence to handle personal data correctly, helping reduce the risk of data breaches and support compliance across your organisation.
The course covers the lawful basis for processing, data protection principles, individual rights, accountability, data breaches and practical data security.
Find out about UK GDPR Training on our website, or contact our friendly team today on 0203 011 4242 / [email protected]
Tom Paxman
Managing Director (Digital)
