Every organisation that processes personal data must understand the lawful bases for processing personal data. Under the UK GDPR, these reasons are known as the lawful bases for processing.
Choosing the correct lawful basis is an important part of data protection compliance. It affects whether you can process personal data in the first place, what you must tell people about that processing and some of the rights individuals have over their information.
One of the most common misconceptions about the UK GDPR is that organisations always need consent to process personal data. They do not. Consent is just one of the lawful bases available and, in many circumstances, another basis will be more appropriate.
The important question is therefore not simply:
“Do we have permission to process this information?”
Instead, organisations should ask:
“Why do we need to process this personal data, and which lawful basis most accurately reflects that purpose?”
This guide explains the lawful bases available under the UK GDPR, how they differ and how organisations can determine which basis applies to their processing.
Contents
- What Is Personal Data Processing?
- Why Do You Need a Lawful Basis?
- What Does Article 6 of the UK GDPR Require?
- The Lawful Bases at a Glance
- How Do You Choose the Correct Lawful Basis?
- Consent
- Contract
- Legal Obligation
- Vital Interests
- Public Task
- Legitimate Interests
- Recognised Legitimate Interests
- Special Category and Criminal Offence Data
- How Your Lawful Basis Affects People’s Rights
- Can You Change Your Lawful Basis?
- Can You Use Different Lawful Bases for Different Purposes?
- Demonstrating Compliance
- Common Mistakes
- Practical Checklist
- Conclusion
What Is Personal Data Processing?
Before considering lawful bases, it is important to understand what we mean by personal data and processing.
Personal data is information relating to an identified or identifiable living individual.
This includes obvious information such as someone’s:
- name;
- address;
- telephone number;
- email address; or
- employee number.
But information does not necessarily have to identify someone by itself. Information that can identify an individual when combined with other information may also be personal data.
Processing is an equally broad concept.
It covers almost anything an organisation does with personal data, including:
- collecting it;
- recording it;
- storing it;
- accessing it;
- organising it;
- analysing it;
- changing it;
- sharing it;
- using it; and
- deleting or destroying it.
As a result, almost every organisation processes personal data and must therefore understand the lawful bases available under the UK GDPR.
Why Do You Need a Lawful Basis?
The UK GDPR is underpinned by a number of data protection principles.
The first requires personal data to be processed lawfully, fairly and transparently.
Having an appropriate lawful basis is therefore fundamental to lawful processing.
However, choosing the correct basis has consequences beyond simply complying with the first principle.
Your lawful basis can affect:
- whether you are permitted to process personal data;
- what information you must provide in your privacy notice;
- which data protection rights apply;
- how you respond if somebody objects to processing;
- whether information can continue to be retained;
- what evidence you need to demonstrate compliance.
The accountability principle also requires organisations to be able to demonstrate compliance with the UK GDPR.
It is therefore not enough to process personal data for what seems like a reasonable purpose. You should understand and document why that processing is lawful.
What Does Article 6 of the UK GDPR Require?
Article 6 of the UK GDPR sets out the lawful bases for processing personal data.
Traditionally these are described as six bases:
- Consent
- Contract
- Legal obligation
- Vital interests
- Public task
- Legitimate interests
Changes introduced through the Data (Use and Access) Act 2025 also provide for recognised legitimate interests. These sit within the legitimate-interests framework but alter the assessment required for certain specified types of processing.
The existence of several lawful bases reflects an important feature of data protection law:
There are many legitimate reasons why organisations need to process information about people.
Consent is therefore not automatically preferable to the other bases. The correct basis is the one that most accurately reflects why the processing is necessary.
The Lawful Bases at a Glance
- Consent The individual has genuinely chosen to agree to the processing
- Contract Processing is necessary for a contract with the individual or to take requested steps before entering into one
- Legal obligation Processing is necessary because the organisation must comply with the law
- Vital interests Processing is necessary to protect someone’s vital interests, normally their life
- Public task Processing is necessary to perform a task in the public interest or exercise official authority with a basis in law
- Legitimate interests Processing is necessary for a legitimate interest that is not overridden by the individual’s interests, rights or freedoms
There are important conditions and limitations attached to each basis. You should therefore avoid choosing one simply because its description appears to fit.
How Do You Choose the Correct Lawful Basis?
Start with the purpose of the processing.
Ask:
What exactly are we trying to achieve by processing this personal data?
You can then consider which lawful basis best reflects that purpose.
For example:
Has the person genuinely been offered a choice?
Consider consent.
Is processing objectively necessary to deliver a contract with the individual or take steps they have requested before entering into one?
Consider contract.
Does the law require you to undertake the processing?
Consider legal obligation.
Is the processing necessary to protect someone’s life or other vital interests?
Consider vital interests.
Is the processing necessary to carry out a legally based public function or exercise official authority?
Consider public task.
Is there another legitimate purpose requiring the processing?
Consider legitimate interests, including whether the processing falls within a recognised legitimate interest.
These questions are a starting point. The precise requirements of the relevant lawful basis must still be satisfied.
Importantly, organisations should normally determine their lawful basis before processing begins, rather than trying to find a justification afterwards.
Consent
Consent is probably the best-known lawful basis, but that does not mean it should always be the first choice.
Consent is most appropriate where people are genuinely being offered control over whether their personal data will be processed.
Valid consent must be:
- freely given;
- specific;
- informed;
- unambiguous;
- demonstrated through a clear affirmative action; and
- capable of being withdrawn.
This means consent should not be used where an organisation intends to process someone’s personal data regardless of whether they agree.
For example, an employer cannot realistically ask an employee to consent to the processing necessary to pay their salary if the employer intends to process that information whether consent is provided or not.
A useful question is:
“What would we do if the individual said no?”
If the answer is that you would process the information anyway, consent is unlikely to be the correct lawful basis.
It is also important to remember that activities such as electronic direct marketing may be subject to additional rules under the Privacy and Electronic Communications Regulations (PECR).
Contract
The contractual lawful basis applies where processing is necessary:
- to perform a contract with the individual; or
- to take steps at their request before entering into a contract.
For example, an online retailer will need a customer’s name and delivery address to send them the goods they have purchased.
The important word is necessary.
The existence of a contract does not mean every processing activity associated with that customer automatically falls under the contractual lawful basis.
An organisation cannot simply add a provision to its terms and conditions stating that personal data will be used for advertising, profiling or analytics and then claim that processing is necessary for the contract.
Ask:
Could we fulfil the contract without this processing?
If the answer is yes, you may need another lawful basis.
Legal Obligation
The legal obligation basis applies where processing personal data is necessary for an organisation to comply with the law.
For example, organisations may need to process personal data to comply with requirements relating to:
- taxation;
- employment;
- health and safety;
- regulatory reporting;
- statutory record keeping; or
- legally required disclosures.
An employer, for example, has legal obligations relating to checking whether individuals have the right to work in the UK.
Organisations should be able to identify the legal obligation underlying their processing.
Simply saying that something is “required by law” without understanding what that requirement is provides weak evidence of compliance.
Again, necessity matters. The fact that a law creates an obligation does not justify collecting or using more personal data than is necessary to meet it.
Vital Interests
Vital interests can provide a lawful basis where processing is necessary to protect someone’s life or interests essential to their life.
It is particularly relevant to emergency situations.
For example, where an unconscious person requires emergency medical treatment, healthcare professionals may need to process personal data necessary to protect that person’s vital interests.
The individual whose personal data are being processed does not necessarily have to be the person whose vital interests are being protected.
However, vital interests is a relatively narrow lawful basis. It should not be interpreted simply as allowing processing whenever an organisation believes doing so would benefit or protect somebody.
Public Task
The public task lawful basis is particularly important for public authorities and organisations exercising official functions.
It applies where processing is necessary for:
- performing a task carried out in the public interest; or
- exercising official authority.
The relevant task, function or authority must have an appropriate basis in law.
The legislation does not necessarily need to say explicitly that personal data may be processed. Instead, the organisation must be able to identify the underlying legal basis for the function and demonstrate that processing the personal data is necessary to perform it.
For example, NHS organisations process substantial amounts of personal data to provide healthcare services. Their underlying statutory functions provide the legal framework for those activities even though legislation does not need to specify every individual processing activity required to deliver healthcare.
Legitimate Interests
Legitimate interests provides greater flexibility than many of the other lawful bases, but that flexibility comes with additional responsibilities.
It may apply where processing is necessary to pursue a legitimate interest belonging to:
- your organisation;
- another organisation or third party; or
- wider society.
Examples might include:
- cyber security;
- fraud prevention;
- physical security;
- debt recovery;
- network monitoring; or
- some forms of internal administration.
However, identifying a legitimate interest is only the beginning.
Organisations should normally consider a three-part test.
1. Purpose Test
Is there a genuine and clearly defined legitimate interest?
2. Necessity Test
Is processing personal data necessary and proportionate to achieving that interest, or could it reasonably be achieved in a less intrusive way?
3. Balancing Test
Are the legitimate interests overridden by the interests, rights or freedoms of the individuals concerned?
The balancing test should consider matters such as the nature of the information, people’s reasonable expectations, the potential impact of processing and whether children or other vulnerable people are involved.
Organisations commonly document this decision through a Legitimate Interests Assessment (LIA).
Legitimate interests should therefore not be treated as a convenient fallback where another lawful basis is difficult to apply.
Recognised Legitimate Interests
The Data (Use and Access) Act 2025 introduced the concept of recognised legitimate interests into the UK data protection framework.
This identifies particular interests in legislation for which the usual balancing exercise associated with ordinary legitimate interests is not required in the same way.
Specified areas include processing associated with matters such as:
- certain disclosures connected with public tasks;
- national security and defence;
- emergencies;
- crime prevention and detection; and
- safeguarding vulnerable individuals.
The important distinction is that organisations do not simply decide for themselves that an interest should be “recognised”.
The processing must genuinely fall within one of the categories recognised in legislation and satisfy the applicable statutory requirements.
The change therefore provides greater certainty for specified processing activities, but it does not remove the wider requirements of the UK GDPR. Organisations must still consider matters such as necessity, data minimisation, purpose limitation, security and transparency.
Special Category and Criminal Offence Data
Article 6 is not always the end of the lawful basis assessment.
Some personal data receive additional protection.
Special category data include information revealing or concerning matters such as:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used for identification;
- health; and
- sex life or sexual orientation.
Where special category data are processed, an organisation will normally need:
an Article 6 lawful basis
plus
an appropriate Article 9 condition.
The Article 9 condition is additional to the Article 6 lawful basis rather than simply being another Article 6 basis.
There are also separate requirements for processing criminal offence data.
Organisations should therefore identify the type of personal data involved as well as the purpose for processing it.
How Your Lawful Basis Affects People’s Rights
Choosing the correct lawful basis is also important because the lawful basis can affect how some individual rights apply.
For example:
- where processing relies on consent, the individual can withdraw that consent;
- the right to data portability applies in particular circumstances involving consent or contract;
- the right to erasure does not apply in exactly the same way to every lawful basis;
- individuals have an important right to object to processing based on public task or legitimate interests.
The lawful basis should therefore not be considered separately from data subject rights.
When designing a processing activity, organisations should consider both:
Why are we permitted to process the data?
and
What rights will individuals have in relation to that processing?
Can You Change Your Lawful Basis?
Organisations should not treat lawful bases as interchangeable.
For example, an organisation should not obtain consent and then, when somebody withdraws that consent, simply decide that it will continue the same processing under legitimate interests.
That undermines the transparency and fairness of the original processing.
This does not mean that different lawful bases can never apply as circumstances change.
For example, personal data may initially be processed because it is necessary to perform a contract. Once the contract ends, the organisation may have a separate legal obligation requiring it to retain particular records.
The important distinction is between:
a genuine change in the purpose or circumstances of processing
and
changing the lawful basis simply because the original one has become inconvenient.
Can You Use Different Lawful Bases for Different Purposes?
Yes.
One of the most important things to understand is that organisations do not necessarily choose one lawful basis for everything they do with a particular person’s information.
Consider an employer.
It might process employee personal data:
- under contract where necessary to fulfil contractual arrangements;
- under legal obligation for tax or statutory employment requirements;
- under legitimate interests for appropriate security activities; and
- under vital interests in an exceptional emergency.
The correct lawful basis therefore relates to the specific purpose for processing, rather than simply the person or dataset involved.
This is another reason why clearly defining processing purposes is such an important part of GDPR compliance.
Demonstrating Compliance
The accountability principle requires organisations to demonstrate that they comply with data protection law.
Your decisions about lawful bases should therefore be documented.
Depending on the processing, relevant evidence might include:
- Records of Processing Activities;
- privacy notices;
- Legitimate Interests Assessments;
- consent records;
- Data Protection Impact Assessments;
- policies and procedures;
- data maps;
- contracts; and
- governance records.
Your privacy information should explain the purposes for which personal data are processed and identify the relevant lawful basis.
Lawful bases should also be reviewed where the purpose or circumstances of processing materially change.
Common Mistakes
Organisations frequently make similar mistakes when choosing lawful bases.
Assuming consent is always required
The GDPR provides several lawful bases. Consent is appropriate only where its specific requirements can genuinely be met.
Confusing notification with consent
Telling someone that you intend to process their data does not mean they have consented to it.
Using legitimate interests as the default
Its flexibility does not remove the need to satisfy the purpose, necessity and balancing requirements.
Assuming a contract covers everything
Processing must actually be necessary to perform the contract or take requested pre-contractual steps.
Failing to identify the relevant law
If relying on legal obligation or public task, organisations should understand the legal framework supporting the processing.
Using one lawful basis for every purpose
Different activities involving the same individual or dataset may require different lawful bases.
Treating Article 9 conditions as substitutes for Article 6
Special category data normally require both an Article 6 basis and an Article 9 condition.
Changing lawful basis when the original becomes inconvenient
Lawful bases should be determined properly at the outset rather than retrospectively changed to justify continued processing.
Failing to document the decision
If you cannot explain why a lawful basis applies, it becomes much harder to demonstrate accountability.
Practical Checklist
Before processing personal data, ask:
✓ What are we trying to achieve?
Clearly define the purpose of processing.
✓ What personal data do we actually need?
Apply the data minimisation principle.
✓ Why is processing necessary?
Identify the underlying reason rather than simply describing what you want to do.
✓ Which Article 6 lawful basis most accurately reflects that reason?
Do not automatically default to consent or legitimate interests.
✓ Are we processing special category or criminal offence data?
Identify any additional legal requirements.
✓ Have we considered people’s rights?
Understand how the chosen basis affects them.
✓ Do we need an additional assessment?
For example, a Legitimate Interests Assessment or Data Protection Impact Assessment.
✓ Have we documented the decision?
Ensure you can demonstrate why the basis applies.
✓ Does our privacy information reflect what we actually do?
People should be told why their information is being processed and the lawful basis relied upon.
✓ Will we review our decision?
Changes in purposes or circumstances may require the processing to be reassessed.
Conclusion: The Lawful Bases for Data Processing
Every organisation processes personal data for a reason. The purpose of the lawful bases under the UK GDPR is to ensure those reasons are legally justified.
The starting point should therefore not be asking whether you can obtain consent or whether legitimate interests might provide a convenient justification.
Instead ask:
Why do we need to process this personal data?
Once the purpose is clearly understood, organisations can identify the lawful basis that genuinely reflects why the processing is necessary.
Consent, contract, legal obligation, vital interests, public task and legitimate interests each address different circumstances. Changes introduced through recognised legitimate interests provide additional certainty for particular specified activities, but do not remove the wider responsibilities imposed by data protection law.
Choosing the correct lawful basis is also only one part of compliance. Processing must remain fair and transparent, use no more personal data than necessary, respect people’s rights and comply with all the other principles of the UK GDPR.
Above all, organisations should be able to explain and demonstrate their decision.
A lawful basis should never be something identified retrospectively because somebody has asked a difficult question. It should be a deliberate and documented part of designing lawful, fair and accountable data processing.