DataTerminology.comNEW
Also known as: Lawful Basis for Processing
A legal justification required to process personal data under regulations like GDPR, such as consent, contract, or legitimate interests.
DESCRIPTION
Lawful basis is the legal foundation that permits personal data processing. Under GDPR, six bases include consent, contract, legal obligation, vital interests, public task, and legitimate interests. Organizations must document and communicate their lawful basis and ensure it aligns with the purpose of processing. Selecting the wrong basis can undermine compliance, rights handling, and transparency. Lawful basis choices influence retention, risk, and DPIA needs and must be reviewed for new uses of data.
ALTERNATIVE DEFINITIONS
EUR-Lex
Processing shall be lawful only if and to the extent that at least one of the following applies:
Direct quotation from GDPR Article 6 introducing the legal bases.
Information Commissioner’s Office
You must have a valid lawful basis in order to process personal data.
Clear compliance obligation and necessity of a lawful basis.
CNIL
Processing of personal data must have a legal basis.
Concise statement reinforcing the prerequisite of a legal basis.
European Data Protection Board
Processing is lawful only if one of the legal bases applies, including consent, contract, legal obligation, vital interests, public task, or legitimate interests.
Enumerates the recognized legal bases under GDPR framework.
RELATED TERMS
GDPR Consent Legitimate Interest Contract Legal Obligation Public Task Vital Interests Data Processing Data Subject Rights Data Protection Impact Assessment
COMPETING TERMS
Unlawful Processing
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance AI Governance
TARGET AUDIENCE
Data Privacy Officer Data Governance Manager Chief Data Officer Chief AI Officer IT Auditor AI Product Manager
EXTERNAL SOURCES
- Wikipedia - General Data Protection Regulation
- EUR-Lex - Official GDPR text and legal bases
- ICO - Practical guidance and examples
- EDPB - Guidelines on legal bases
TOP QUESTIONS
Why is Lawful Basis critical for data processing?
It ensures processing is legally justified and transparent. Without a lawful basis, processing may be unlawful, risking fines, reputational damage, and remediation obligations.
Category: Relevancy
How do you choose the Lawful Basis for a new project?
Assess purpose, necessity, and proportionality. Map to one of the six GDPR bases, document the rationale, and communicate in privacy notices.
Category: Requirements
What are common mistakes with Lawful Basis?
Using consent when contract or legitimate interests fit better. Failing to document and update the chosen basis when processing changes.
Category: Mistakes
Can the Lawful Basis change over time?
Yes, if the purpose or context changes. Reevaluate and update notices, DPIAs, and records of processing accordingly.
Category: Management
Is consent always required under Lawful Basis?
No. Consent is one option among six. Other bases include contract, legal obligation, vital interests, public task, and legitimate interests.
Category: Misunderstanding
What risks arise from selecting the wrong Lawful Basis?
Noncompliance, invalid processing, data subject complaints, and enforcement actions. It may also undermine deletion or portability rights.
Category: Risk
How does Lawful Basis relate to DPIAs?
The chosen lawful basis informs risk assessment, necessity, and safeguards. DPIAs document impacts and mitigations aligned with the legal basis.
Category: Requirements
What hot topics surround Lawful Basis today?
Legitimate interests in AI training, consent for cookies and tracking, and contract vs. necessity in personalized services.
Category: Topic
Where should teams start learning about Lawful Basis?
Read GDPR Article 6, consult regulator guidance (ICO, EDPB), and review case studies for practical applications and pitfalls.
Category: Overview