Lawful basis navigator
Decision tool Data protectionStart from what you are trying to do and get the UK GDPR basis to test first, with the extra condition you need for special category data.
What is the processing for?
Are you a public authority processing in performance of your tasks?
Points (ea) and (f) of Art 6(1) do not apply to processing by public authorities in the performance of their tasks.
Public task (Art 6(1)(e))
Test whether the processing is necessary for a task in the public interest or in the exercise of official authority with a clear basis in law (DPA 2018 s.8 gives examples). If special category data is involved, add an Art 9 condition and the Schedule 1 condition.
Basis: UK GDPR Art 6(1)(e); DPA 2018 s.8
Recognised legitimate interest (Art 6(1)(ea))
No balancing test is needed if the processing is necessary for a condition in Annex 1. Record which Annex 1 condition you rely on. In force from 2026-02-05.
Basis: UK GDPR Art 6(1)(ea), Art 6(5), Annex 1
A basis plus the research rules
Research is not a basis on its own. Pick the Art 6 basis (often public task, legitimate interests or consent; consent can now cover an area of scientific research) and apply the research safeguards. For special category data, Art 9(2)(j) with DPA 2018 Sch 1 para 4.
Basis: UK GDPR as amended by DUAA 2025 ss.67, 68 and 86
PECR first, then the UK GDPR
Whether you may send electronic marketing is a PECR question (consent or a soft opt-in). The UK GDPR basis for the processing is then usually consent or legitimate interests. An objection to direct marketing is absolute.
Basis: PECR regs 21 and 22; UK GDPR Art 6, Art 21
Contract (Art 6(1)(b))
Only for processing genuinely necessary to perform the contract with this person, not for everything a business wants to do with customer data.
Basis: UK GDPR Art 6(1)(b)
Legal obligation (Art 6(1)(c))
Identify the specific UK law that requires the processing. A contractual obligation does not count.
Basis: UK GDPR Art 6(1)(c), Art 6(3)
Vital interests (Art 6(1)(d))
Life-or-death situations where another basis is not available. For health data where the person cannot consent, Art 9(2)(c).
Basis: UK GDPR Art 6(1)(d); Art 9(2)(c)
Legitimate interests (Art 6(1)(f))
Run the three-part test: purpose, necessity, balance. Record it.
Basis: UK GDPR Art 6(1)(f)
Consent (Art 6(1)(a))
Consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give. Avoid it where there is a power imbalance, such as employment.
Basis: UK GDPR Art 4(11), Art 7
Sources
- Primary UK GDPR Article 6 legislation.gov.uk
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary Data Protection Act 2018 (c. 12) legislation.gov.uk