What is a lawful basis, and which one do you need?

What it is

A lawful basis is the legal reason that makes processing lawful. Most bases require the processing to be necessary for a stated purpose, so if you can reasonably achieve the purpose without the data, the basis does not apply. The basis also affects people's rights: for example, portability applies only to consent and contract, and the right to object applies to public task and legitimate interests.

The seven bases

• Consent: the person has given clear, freely given consent for a specific purpose. Art 6(1)(a)
• Contract: necessary for a contract with the person, or steps they asked for before one. Art 6(1)(b)
• Legal obligation: necessary to comply with UK law. Art 6(1)(c)
• Vital interests: necessary to protect someone's life. Art 6(1)(d)
• Public task: necessary for a task in the public interest or official function with a clear basis in law. Art 6(1)(e)
• Recognised legitimate interests: a purpose listed in Annex 1, such as safeguarding, crime prevention or emergencies, with no balancing test. In force from 2026-02-05. Art 6(1)(ea); Annex 1
• Legitimate interests: necessary for your or a third party's legitimate interests, unless the person's interests override them. Art 6(1)(f)

Limits

• Public authorities cannot use legitimate interests or recognised legitimate interests for processing in performance of their tasks. Art 6(1), words after point (f)
• Special category and criminal offence data need an Art 9 or Art 10 condition on top of the basis. Arts 9 and 10

Who is responsible

The controller, which must decide the basis before processing, record it and tell people in its privacy notice.

What it involves

1. Define the purpose precisely.
2. Check whether the processing is necessary for it.
3. Pick the basis that fits, and record why.
4. Tell people the basis in your privacy notice.
5. Do not swap bases later to rescue processing.

If it goes wrong

Regulatory

Processing without a lawful basis breaches Arts 5(1)(a) and 6. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence for lacking a basis, but unlawfully obtaining or disclosing data is an offence under DPA 2018 s.170.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.