The Six Lawful Bases Under GDPR Article 6: How to Choose the Right One

The six bases

Processing is lawful only if, and to the extent that, at least one of these applies (Article 6(1)):

There is no hierarchy between them. Public authorities cannot rely on legitimate interests for processing in the performance of their tasks (Article 6(1), second subparagraph). For bases (c) and (e), the legal basis must be laid down in EU or member state law (Article 6(3)).

"Necessary" means strictly necessary

Five of the six bases require processing to be necessary. In Meta Platforms v Bundeskartellamt (C-252/21, 4 July 2023), the Court of Justice gave this word teeth:

• Contract: processing is necessary for performing a contract only if it is objectively indispensable for a purpose that is integral to the contractual obligation, so that the main subject matter of the contract cannot be achieved without it. Useful or written into the terms is not enough.
• Legitimate interests: the controller must have informed people of the interest pursued, the processing must be limited to what is strictly necessary for it, and the balancing must show that people's interests and rights do not override it.
• Legal obligation: the processing must actually be necessary to comply with an obligation in EU or national law that meets a public interest objective and is proportionate, and be limited to what is strictly necessary.

Common mistake: putting analytics, personalised advertising or product improvement under "contract" because the terms of service mention them. Unless the service cannot be delivered without them, they need another basis, usually consent or legitimate interests.

Consent done properly

Consent must be freely given, specific, informed and unambiguous, given by a statement or clear affirmative action (Article 4(11)). Article 7 adds:

• you must be able to demonstrate that consent was given (Article 7(1));
• a request in a document that covers other matters must be clearly distinguishable, intelligible and in plain language (Article 7(2));
• people can withdraw at any time, and withdrawing must be as easy as giving consent (Article 7(3));
• when assessing whether consent is freely given, account is taken of whether a contract is made conditional on consent to processing that is not necessary for it (Article 7(4)).

A dominant market position does not in itself make consent invalid, but it is an important factor in assessing whether consent was freely given (C-252/21). Consent is also hard to use in employment, where the imbalance of power usually means consent is not free. For cookies, consent is required first by the ePrivacy rules; see cookie banner requirements.

Legitimate interests: the three-part test

Identify a lawful, clearly articulated, real and present interest; show the processing is necessary for it; and balance it against people's interests, rights and reasonable expectations. Write it down as a legitimate interest assessment. Our legitimate interest assessment guide walks through it. Remember that people can object to processing based on legitimate interests (Article 21(1)), and always to direct marketing (Article 21(2)).

Special category data needs more

Health, biometric, genetic data and the other special categories in Article 9(1) need both an Article 6 basis and one of the conditions in Article 9(2), such as explicit consent, employment law obligations, or substantial public interest under law. In the same Meta ruling, the Court held that data revealing special categories, for example from visits to health-related websites, is special category data, which the rules prohibit in principle unless an exception applies.

Changing the purpose

If you want to use data for a new purpose not based on consent or a law, check whether it is compatible with the original purpose, taking into account the link between the purposes, the context and relationship with the people, the nature of the data, the possible consequences and safeguards such as encryption or pseudonymisation (Article 6(4)).

How to choose and document

1. List each processing purpose separately, for example "delivering orders", "fraud prevention", "newsletter", "product analytics".
2. For each purpose, start with the bases that need no balancing: is it required by law (c), or truly indispensable for the contract (b)?
3. If neither, consider legitimate interests (f) and do the assessment; if the balance fails or the processing is intrusive, use consent (a).
4. Record the basis per purpose in your records of processing and state it in your privacy notice (Article 13(1)(c)).
5. Decide before you start. The EDPB considers that a controller cannot switch to another basis after the fact to justify processing, for example when consent is withdrawn.

Record a basis for every purpose. The GDPR Records of Processing (RoPA) Kit includes controller and processor RoPA templates with a legal basis field, a legitimate interest assessment template, a consent record template and a completion guide.

Sources

• Regulation (EU) 2016/679 (GDPR), Articles 4(11), 6, 7, 9, 13 and 21, EUR-Lex
• Court of Justice, Meta Platforms and Others (General terms of use of a social network), C-252/21, 4 July 2023, EUR-Lex
• EDPB Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1
• EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0

Related tools