What is a lawful basis?
A lawful basis is the legal justification that permits an organisation to process personal data for a specific purpose. Under the GDPR, recognised bases include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task and legitimate interests.
The basis should be selected before processing begins and should reflect the real activity. It is not a label chosen after a project has launched. The selected basis affects transparency, individual rights and whether the processing can continue when circumstances change.
How is a lawful basis selected?
Teams should define the purpose, data, affected people and necessity. They should ask whether processing is required by law or contract, whether a public function applies, whether the person has a genuine choice or whether a legitimate-interest balancing exercise is appropriate.
Convenience alone is not sufficient. The analysis should consider less intrusive alternatives and any additional conditions for sensitive or criminal-offence data.
Why does the lawful basis matter?
Different bases create different obligations and rights. Consent can be withdrawn. A person may object to processing based on legitimate interests or public task. Contract should be limited to processing objectively necessary to perform the requested service.
Incorrect selection can lead to misleading notices and weak accountability. Switching bases later simply to avoid a right or failed condition is generally problematic.
How should the basis be documented?
The organisation should record the purpose, selected basis, reasoning, alternatives, affected groups and any supporting assessment. The basis should be reflected consistently in the privacy notice, record of processing and product or operational controls.
Review is needed when the purpose, relationship or data changes. A basis valid for one purpose does not automatically permit a new, incompatible use.
Frequently asked questions
Is consent the safest lawful basis?
Not always. Consent is valid only when there is a genuine choice and the organisation can honour withdrawal. Another basis may more accurately reflect necessary processing.
Can more than one basis apply?
Different purposes may rely on different bases. Organisations should avoid listing every possible basis without identifying which supports each activity.
Is contract a basis for marketing?
Usually not merely because a person is a customer. Marketing should be assessed separately under applicable privacy and communications rules.
Does a lawful basis remove the need for transparency?
No. Organisations must still provide clear information, follow the principles and support applicable rights.
Who approves the lawful basis?
The business owner should provide facts, with legal or privacy review proportionate to the complexity and risk.