Lawful basis (GDPR)
Also called legal basis for processing.
One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.
Last updated
What it is.
GDPR Article 6(1) says processing is lawful only if at least one of these applies: the person gave consent; it is necessary for a contract with them; it is necessary for a legal obligation; it protects someone's vital interests; it is necessary for a task in the public interest or official authority; or it is necessary for the legitimate interests of the controller or a third party, unless the person's rights override them.
The controller picks the basis for each purpose before processing starts and tells people which one applies. Special categories, such as health data, need an extra condition under Article 9.
Why it matters
The basis decides what the product must do. Consent needs a clear opt-in, a record of it and an easy way to withdraw. A contract basis covers what is truly needed to deliver the service, not extras like marketing. Getting it wrong can make the whole processing unlawful.
In a product build
Each lawful basis turns into concrete screens and data: consent banners and toggles, a consent log, opt-out links and settings. Listing them per purpose during discovery keeps them in scope.
Common mistakes.
- 01
Using consent for everything, then having no basis left when someone withdraws it.
- 02
Claiming contract necessity for things the service does not need, such as ad tracking.
- 03
Not recording which basis applies to which purpose.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data controller (GDPR)Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- DPIA (data protection impact assessment)An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk.
- Data subject request (DSR)A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere.
- Data processor (GDPR)Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
Guides and pages
Browse the full glossary or read answers to common questions.
