Every use of personal data under GDPR needs a lawful basis from the closed list in Article 6(1). There are exactly six, no others, and the choice determines which rights apply, what your privacy notice must say, and how much scrutiny the processing attracts. This guide provides a decision path through the six bases and explains where organizations most often get the choice wrong.
| Regulation | GDPR, Article 6 |
|---|---|
| Max penalty | EUR 20M or 4% of global annual turnover |
| Enforcing authority | National supervisory authorities, coordinated by the EDPB |
| Official text | EUR-Lex CELEX 32016R0679 |
The six bases, in decision order
Work through these in order for each processing purpose:
- Legal obligation (Art. 6(1)(c)). Does an EU or member state law require the processing, such as tax record retention? If yes, stop here and cite the law.
- Contract (Art. 6(1)(b)). Is the processing objectively necessary to deliver the contract the individual signed up for? Necessary means the contract cannot be performed without it, not merely that it is mentioned in your terms.
- Vital interests (Art. 6(1)(d)). Life-or-death situations only. Rarely applicable outside emergency care.
- Public task (Art. 6(1)(e)). For public authorities and bodies exercising official authority.
- Legitimate interests (Art. 6(1)(f)). The flexible basis for everything from fraud prevention to network security, but only after a documented balancing test, and never for public authorities’ core tasks.
- Consent (Art. 6(1)(a)). The fallback when nothing else fits, and the mandatory basis where ePrivacy rules require it, such as non-essential cookies and most electronic marketing.
Where organizations get it wrong
The highest-profile lawful basis failures involve stretching contract or legitimate interests to cover advertising. In January 2023 the Irish DPC, on EDPB instruction, fined Meta EUR 390 million for relying on contractual necessity to run behavioral ads on Facebook and Instagram. The EDPB’s position is that personalized advertising is not necessary to deliver a social network. The follow-on lesson applies broadly: if the individual would be surprised, or would object if asked, legitimate interests probably fails its own balancing test and consent is the honest option.
The second common failure is treating consent as valid when it is not: pre-ticked boxes, bundled consent, or banners where refusing takes three clicks and accepting takes one. Invalid consent means no lawful basis at all, which converts every downstream use of the data into a violation.
Documenting the decision
For each purpose in your records of processing, record the basis, the reasoning, and the date. For legitimate interests, attach the LIA. For consent, keep proof of what the individual saw and when they agreed, because Article 7(1) puts the burden of demonstrating consent on you. Our consent management guide covers the mechanics.
A quick reality check: your website’s trackers each need a basis too, and most need consent. A free scan shows which third parties receive data from your site before any consent is given, which is exactly the evidence a complainant would present.