Organisations can process personal data where doing so is necessary to comply with a legal obligation, but they must be able to identify that obligation and demonstrate why the processing is necessary.
This article explains what constitutes a legal obligation, how this differs from other lawful bases, and how organisations can demonstrate that their processing is justified, structured around four questions:
- What does the legal obligation lawful basis mean?
- When can an organisation rely on it?
- How does it differ from public task and other lawful bases?
- What must an organisation do to demonstrate compliance?
When Does the Law Require You to Process Personal Data?
Fulfilling certain legal duties will require you to process personal data from time to time. For example, employers must process employee information to meet certain tax and payroll obligations. Businesses may need to retain financial records for statutory accounting purposes. Some organisations are required to disclose information to regulators or other authorities.
In these circumstances, processing personal data is not simply something the organisation chooses to do. It may be necessary to comply with a legal requirement.
The UK GDPR recognises this through the legal obligation lawful basis, set out in Article 6(1)(c).
However, not every legal or regulatory concern justifies processing personal data. Organisations must identify the relevant obligation and establish that the processing is necessary to comply with it.
This article will help you distinguish genuine legal obligations from processing that supports your business objectives.
What Does the UK GDPR Say?
Article 6(1)c of the UK GDPR says processing personal data is lawful where that processing is necessary for compliance with a legal obligation to which the controller is subject.
Note the three core elements:
- Necessary: The processing must be reasonably necessary and proportionate for meeting the obligation.
- Legal obligation: There must be an identifiable obligation established by applicable law.
- Controller: The obligation must apply to the organisation acting as controller.
This means that where a legal obligation makes it necessary to process personal data then the GDPR still applies. A legal obligation can justify particular processing, but the other data protection principles and relevant requirements continue to apply.
What Counts as a Legal Obligation?
For this lawful basis to apply you must have to process personal data to meet a requirement set out in UK law. This includes secondary legislation, local by-laws and the common law.
It does not include processing personal data for things that could lead to civil legal action, so this lawful basis cannot justify processing personal data to fulfil a contract. For example, an employer’s statutory duty to report payroll information may support Article 6(1)(c). Processing necessary to fulfil an employment contract may instead fall under Article 6(1)(b), processing for the performance of a contract. Conversely an organisation’s understandable desire to reduce the risk of litigation or demonstrate good business practice is not enough to meet the requirements of Article 6(1)c.
Practical Examples of the Legal Obligation Lawful Basis
Things that often are (and are not) examples of processing personal data to meet a legal obligation include:
- Payroll and tax reporting: Employers process relevant employee information to meet statutory reporting requirements
- Financial recordkeeping: Organisations retain certain records to meet accounting or tax obligations
- Health and safety reporting: Employers disclose relevant information where legally required to report specified incidents
- Regulatory disclosures: Organisations provide personal data where a valid legal requirement obliges them to do so
- Anti-money laundering checks: Regulated organisations undertake legally required identity verification and record keeping
For each example the organisation must identify the specific applicable obligation rather than assume the lawful basis applies automatically.
Because the privacy principles still apply to personal data processed under this lawful basis appropriate retention periods still apply. For example, imagine an organisation wants to retain all former employee emails indefinitely in case of future legal disputes.
That does not automatically establish Article 6(1)(c). The organisation would need to identify a relevant legal obligation requiring that retention, or consider whether another lawful basis is appropriate for a defined and proportionate retention purpose.
What Does “Necessary” Mean Under Article 6(1)(c)?
This lawful basis does not give organisations unlimited permission to process personal data merely because a legal obligation exists.
The processing must be a reasonable and proportionate means of complying with the obligation.
You can use these three questions to test necessity:
- Is the personal data genuinely needed to meet the legal requirement?
- Could the obligation reasonably be met without processing that information?
- Are we collecting, using or retaining more information than the obligation requires?
For example while an employer may need to retain payroll records for statutory purposes. That does not automatically justify retaining every document relating to an employee indefinitely.
Legal Obligation Versus Public Task: What’s the Difference?
Some organisations, particularly in the public sector or with public sector contracts, may fail to distinguish between the public task lawful basis and the legal obligation lawful basis.
They are distinct legal bases for processing personal data and apply in different ways. Let’s compare the two:
| Legal obligation — Article 6(1)(c) | Public task — Article 6(1)(e) |
| Processing is necessary to comply with a legal duty | Processing is necessary to perform a public interest task or exercise official authority |
| The controller is subject to an identifiable obligation | The task or authority must have a sufficiently clear basis in law |
| Focuses on what the law requires the controller to do | Focuses on carrying out an authorised public function |
| Example: Legally required reporting to HMRC | Example: Processing medical data to provide NHS care |
Organisations can use both lawful bases for different personal data processing activities.
Does Legal Obligation Override Other GDPR Requirements?
As noted above the GDPR applies in full to data processed even when the law requires it. People’s rights work slightly differently, which we discuss below. But, as with all other lawful bases:
- People have the right to be informed about the use of their data for these purposes
- You cannot reuse the data for other purposes that are not directly linked to the original processing activity
- You must keep the information safe and secure, including restricting access and not sharing it more widely than necessary
- The data must be accurate and complete as far as possible
- Do not keep the data for longer than necessary
A legal obligation may explain why an organisation must process personal data, but it does not remove the responsibility to process that information appropriately and securely.
What About Special Category and Criminal Offence Data?
Article 6(1)(c) is not sufficient on its own where special category data are involved.
An organisation must also identify an applicable Article 9 condition and meet any relevant requirements under the Data Protection Act 2018.
For criminal offence data, Article 10 and the relevant UK legal provisions must also be considered.
For example, an employer may have a legal obligation to process certain employee health information for a statutory employment-related purpose. The organisation must still identify an appropriate Article 9 condition.
People’s GDPR Rights
People’s GDPR rights still apply and an organisation cannot simply refuse every request involving information processed under a legal obligation. It must consider the particular right and the processing concerned. However, when processing personal data for a legal obligation GDPR rights work slightly differently and are sometimes more limited than for other lawful bases.
| GDPR right | Position under legal obligation |
| Right to be informed | Applies, subject to relevant exceptions |
| Right of access | Generally applies |
| Right to rectification | Generally applies |
| Right to restriction | Applies in relevant circumstances |
| Right to erasure | Does not ordinarily apply to processing necessary for compliance with a legal obligation; other grounds may require consideration |
| Right to data portability | Does not apply on this basis |
| Right to object under Article 21(1) | Does not apply to processing based solely on Article 6(1)(c) |
How to Demonstrate That Legal Obligation Is the Correct Lawful Basis
There are five key questions to ask to help ensure you have chosen the correct lawful basis,
Five steps to justify processing under legal obligation
1 What specific law, court order or binding legal requirement applies?
2 Does the obligation apply to your organisation as controller?
3 What personal data must be processed to comply?
4 Are special category conditions, security or other safeguards needed?
5 Record your decision and provide appropriate privacy information
It is important that you record your reasoning in its relevant processing documentation, such as its record of processing activities, and ensure its privacy information accurately reflects the processing. In the event of a complaint or regulatory investigation you must be able to show your reasoning for each of the above.
Common Mistakes When Relying on Legal Obligation
Organisations make similar mistakes when it comes to the legal obligation lawful basis. They include
- Treating an internal policy as a legal obligation.
- Assuming a contractual obligation automatically qualifies because of legal risks around breach of contract.
- Failing to identify the relevant and specific statutory or common law duty.
- Processing more personal data than necessary.
- Assuming a regulator’s informal request always creates a legal duty to disclose.
- Believing legal obligation overrides the data protection principles pr people’s data rights.
- Assuming personal data can be retained indefinitely of processed due to a legal obligation.
- Failing to document the lawful basis or explain it in privacy information.
Practical Checklist: Can We Rely on Legal Obligation?
You can use thus checklist to help ensure you have everything in place to rely on legal obligation as a lawful basis for data processing.
Conclusion
The legal obligation lawful basis allows organisations to process personal data where this is necessary to comply with a requirement imposed by law.
However, it is not enough to claim that processing is required for compliance. Organisations should be able to identify the relevant legal obligation, explain why the processing is necessary and demonstrate that they continue to meet their wider data protection responsibilities.
Selecting and documenting the correct lawful basis is an important part of demonstrating GDPR accountability.