What legal basis permits processing personal data?

In brief

Personal data may be processed only when at least one legal basis in the General Data Protection Regulation's Article 6 applies. The common bases are consent, contract, statutory obligation and legitimate interests, but Article 6 also includes vital interests and public task or public authority. The right basis depends on why the data is used, not on what feels easiest to document. If the data is sensitive, Article 9 may require an extra condition as well.

First identify personal data and processing

Before choosing a legal basis, the organisation has to know whether the activity is about personal data at all.

Personal data means information linked to an identified or identifiable natural person under the General Data Protection Regulation's Article 4. A name is the easy example. A work email address, an employee number, location data or an online identifier can also point to a person.

Processing is also broad under Article 4. It is not only sending data outside the organisation. It includes collecting, storing, searching, using, changing, disclosing, restricting, deleting and destroying personal data. An employee opening a customer record, HR storing absence information, and a system deleting old user accounts are all processing activities.

This matters because the legal basis is not chosen for a database in general. It is chosen for a purpose. Payroll may have one purpose. Access management may have another. Customer communications may have a third.

A useful work question is simple: what personal data is used, by whom, and for what task? More on recognising personal data is covered in What is personal data, and when does it stop being personal data?.

Six legal bases decide when processing is lawful

The General Data Protection Regulation's Article 6 says processing is lawful only if at least one of six conditions applies. In everyday language, those conditions are six legal bases.

Legal basis in Article 6	What it means at work
Consent	The person gives permission for a specific purpose.
Contract	The processing is needed to perform a contract with the person, or to take pre-contract steps at the person’s request.
Statutory obligation	The controller has a legal duty that requires the processing.
Vital interests	The processing is needed to protect the life or essential interests of the person or another natural person.
Public task or public authority	The processing is needed for a task in the public interest or for the exercise of public authority vested in the controller.
Legitimate interests	The controller or a third party has an interest that needs the processing, unless the person’s interests or fundamental rights and freedoms override it.

For a company, the most common discussion is often between consent, contract, statutory obligation and legitimate interests. For a municipality, statutory obligation, public task and public authority often need special attention, because Article 6 treats public authorities differently when they act in their tasks.

The legal basis must fit the real reason for processing. If the organisation needs data because a law requires it, calling the same processing consent can confuse employees and the person whose data is used. If the organisation needs data to deliver a service under a contract, the contract basis may answer the question better than a consent checkbox.

The legal basis is only one part of data protection. The General Data Protection Regulation's Article 5 also requires principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. These principles are explained further in What do the GDPR's six principles mean at work?.

Consent is permission for a specific purpose, not a safety net

Consent is a legal basis under the General Data Protection Regulation's Article 6 when the person has agreed to processing for one or more specific purposes. Under Article 4, consent is a free, specific, informed and unambiguous expression of the person’s wishes.

In work terms, consent is suitable when the person has a real choice and the purpose is clear. A newsletter sign-up is an easy everyday example. The person understands what address is used and why.

Consent is weaker when the organisation actually has another reason to process the data. If processing is necessary for a contract, the question is not whether the person is happy to give consent. The question is whether the data is needed for that contract. If processing is required by law, the person’s refusal cannot remove the statutory duty.

The General Data Protection Regulation's Articles 13 and 14 also require information about the right to withdraw consent at any time when processing is based on consent. Withdrawal does not change the lawfulness of processing that happened before withdrawal. In practice, this means consent-based processing needs a way to stop future use for that purpose.

Consent is not a general safety net. It does not fix unclear purposes. It does not make unnecessary data necessary. It does not remove the need to explain the processing.

Contract and law answer different questions

Contract and statutory obligation are often mixed in internal discussions. They answer different questions.

Contract under the General Data Protection Regulation's Article 6 applies when processing is needed to perform a contract with the data subject. It also applies when the person asks for steps before entering into a contract. A simple example is using a customer’s delivery details to fulfil an order. The processing is tied to what the person has requested or agreed with the organisation.

Statutory obligation applies when the controller needs to process data to comply with a legal duty. Article 6 says the basis for this processing must be laid down in Union law or Member State law that applies to the controller. The purpose can also be defined in that legal basis.

Public task and public authority are close to statutory obligation, but they are not identical. Article 6 covers processing needed for a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6 also says the basis for this processing must be in Union law or Member State law.

For a municipality, this distinction is practical. A service process may be based on a public task or public authority. An employment-related duty may be based on a statutory obligation. The correct choice depends on the actual task and the law that supports it.

Legitimate interests require a balancing exercise

Legitimate interests can be used when the controller or a third party has an interest that requires processing, unless the data subject’s interests or fundamental rights and freedoms override it. This comes from the General Data Protection Regulation's Article 6.

The word interest means a real reason for the processing. It is not the same as convenience. An organisation may have an operational need, a security need or another legitimate objective. The next question is whether personal data is necessary for that objective.

Then comes the balance. The organisation has to consider the person’s side. What data is used? What would the person reasonably expect in that situation? What could the effect be? Article 6 gives special weight to the situation where the data subject is a child.

There is also a clear limit for public authorities. Article 6 says the legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks. This does not mean that a public authority can never process personal data. It means that, for official tasks, another basis has to fit.

If legitimate interests are used, transparency is part of the work. The General Data Protection Regulation's Articles 13 and 14 require the controller to provide the legitimate interests when processing is based on that Article 6 basis.

Special categories need an extra condition

Some personal data is more sensitive because misuse can harm a person in a serious way. The General Data Protection Regulation's Article 9 calls these special categories of personal data.

Article 9 covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a person, health data, and data concerning a person’s sex life or sexual orientation.

The starting point in Article 9 is a prohibition on processing these categories. Processing is possible only if one of the Article 9 conditions applies. Examples in Article 9 include explicit consent for one or more specific purposes, obligations and specific rights in employment and social security and social protection, vital interests where the person cannot give consent, legal claims, reasons of substantial public interest under law, occupational medicine and health or social care under the stated conditions, public health reasons under law, and archiving, research or statistical purposes under law.

This means there can be two questions, not one. First, which Article 6 legal basis makes the processing lawful? Second, if special category data is involved, which Article 9 condition lifts the prohibition?

A workplace example makes this concrete. Ordinary contact details may need an Article 6 basis. Health data connected to work ability may also require an Article 9 condition. The same file can therefore include data that needs different checks.

The legal basis must be explained and shown

The legal basis is not only an internal label. It must be communicated.

When personal data is collected from the person, the General Data Protection Regulation's Article 13 requires the controller to provide the purposes of processing and the legal basis. When the data is not obtained from the person, Article 14 requires the same type of information. Article 14 also sets timing rules, including that the information must be provided within one month in the situation described there, unless another Article 14 condition applies.

The information must be understandable. The General Data Protection Regulation's Article 12 requires information to be concise, transparent, intelligible and easily accessible, using clear and plain language. For an employee or customer, this means they should be able to see why their data is used without legal guessing.

The organisation also has to be able to show compliance. Article 5 says the controller is responsible for compliance with the principles and must be able to demonstrate it. In practice, this means the basis, purpose and main choices should be documented well enough that the organisation can explain them later.

This connects to data subject rights. A person may ask for access, correction, deletion, restriction or portability depending on the situation. The legal basis can affect how those rights work. More on rights requests is covered in Data subject rights: when a customer asks for their data, you have a month.

What the legal basis does not solve

A legal basis is necessary, but it does not answer every data protection question.

It does not allow data to be used for any later purpose. The General Data Protection Regulation's Article 5 requires purpose limitation. Article 6 also sets factors for assessing further processing for another purpose when it is not based on consent or on Union or Member State law that meets the stated conditions.

It does not remove the need to minimise data. Article 5 requires personal data to be adequate, relevant and limited to what is necessary for the purposes. If a process needs an email address, that does not mean it needs a national identifier.

It does not decide retention by itself. Article 5 requires data to be kept in identifiable form only as long as necessary for the purposes, subject to the conditions stated in the Article.

It does not remove security duties. Article 5 requires processing in a way that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage. If a personal data breach occurs, the General Data Protection Regulation's Articles 33 and 34 may require notification to the supervisory authority or to the data subject. The 72-hour rule for notifying the supervisory authority is explained in Personal data breach: the 72 hours start when an employee notices.

The practical conclusion is narrow and useful. Choose the legal basis for the purpose. Check whether special category data changes the answer. Explain the basis to the person. Keep evidence that the choice was made and understood.