{"head":{"title":"What Is a Lawful Basis Under the GDPR? | OceanLab","description":"A lawful basis is one of six reasons in GDPR Article 6 that make processing personal data legal. What the six are, how to pick one and common mistakes.","canonical":"https://oceanlab.in/glossary/lawful-basis"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"lawful basis","path":"/glossary/lawful-basis"}],"slug":"lawful-basis","term":"Lawful basis (GDPR)","aka":["legal basis for processing"],"category":"Compliance","short":"One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.","body":[["GDPR Article 6(1) says processing is lawful only if at least one of these applies: the person gave consent; it is necessary for a contract with them; it is necessary for a legal obligation; it protects someone's vital interests; it is necessary for a task in the public interest or official authority; or it is necessary for the legitimate interests of the controller or a third party, unless the person's rights override them."],["The ",{"href":"/glossary/data-controller","text":"controller"}," picks the basis for each purpose before processing starts and tells people which one applies. Special categories, such as health data, need an extra condition under Article 9."]],"why":["The basis decides what the product must do. Consent needs a clear opt-in, a record of it and an easy way to withdraw. A contract basis covers what is truly needed to deliver the service, not extras like marketing. Getting it wrong can make the whole processing unlawful."],"example":["A fitness subscription app processes payment details on a contract basis, sends product updates on legitimate interests with an opt-out, and uses consent for optional marketing tracking, with a toggle that switches it off immediately."],"inBuild":["Each lawful basis turns into concrete screens and data: consent banners and toggles, a consent log, opt-out links and settings. Listing them per purpose during discovery keeps them in scope."],"mistakes":[["Using consent for everything, then having no basis left when someone withdraws it."],["Claiming contract necessity for things the service does not need, such as ad tracking."],["Not recording which basis applies to which purpose."]],"related":[{"href":"/glossary/data-controller","label":"Data controller (GDPR)","detail":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others."},{"href":"/glossary/dpia","label":"DPIA (data protection impact assessment)","detail":"An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk."},{"href":"/glossary/data-subject-request","label":"Data subject request (DSR)","detail":"A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere."},{"href":"/glossary/data-processor","label":"Data processor (GDPR)","detail":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}