Lawful Basis
A legal justification under GDPR for processing personal data — one of six bases must apply before processing can begin.
Full Definition
Under GDPR Article 6, every processing activity must be justified by one of six lawful bases: (1) Consent, (2) Performance of a contract, (3) Compliance with a legal obligation, (4) Protection of vital interests, (5) Performance of a task in the public interest, or (6) Legitimate interests of the controller (or a third party), unless overridden by the data subject's interests. The choice of lawful basis has significant implications — it determines what rights the data subject has and what the organisation can do if they object. Controllers must document their chosen lawful basis for each processing activity in their Record of Processing Activities.
How each law treats it
Six lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests. Special category data (Article 9) requires an additional condition.
Consent is the primary basis; non-consent processing is limited to the Section 7 Certain Legitimate Uses list (employment, legal obligations, medical emergencies, specified public interest).
Consent default, with alternatives close to GDPR Article 6 — contract, legal obligation, vital interests, public interest, legitimate interests (narrower than GDPR's).
In practice
- Decide and document the lawful basis per processing activity. The RoPA is where you store it.
- Legitimate interests requires a documented three-part test — purpose, necessity, balancing. Keep the LIA alongside the RoPA entry.
- Consent fatigue is real — don't default to consent when a better basis is available (contract for order fulfilment, legal obligation for tax records).
Common pitfalls
- Switching lawful basis mid-processing without informing the data subject. The GDPR permits it in narrow circumstances; the DPDP is stricter.
- Using legitimate interests for direct marketing in jurisdictions where ePrivacy mandates consent.
- Confusing legitimate interests with contractual necessity — the two have different conditions and different data-subject rights consequences.
Frequently asked questions
Can I rely on contract for marketing emails?+
Only for marketing that is strictly necessary to perform the contract — order confirmations, service announcements. Promotional marketing requires consent in most jurisdictions, especially under ePrivacy.
What's an LIA?+
A Legitimate Interests Assessment — a documented three-part test (purpose test, necessity test, balancing test) that justifies reliance on Article 6(1)(f). The ICO publishes a template; most DPOs maintain their own.
Does DPDP recognise legitimate interests?+
No. The DPDP Act does not include a 'legitimate interests' basis. Non-consent processing is restricted to the Section 7 Certain Legitimate Uses list, which is narrower than GDPR legitimate interests.
Related terms
Legitimate Interest
A lawful basis under GDPR for processing personal data when a controller has a genuine, proportionate interest that is not overridden by the data subject's rights.
Consent Manager
A platform or system used to capture, record, version, and manage individuals' consent for data processing activities.
RoPA
Record of Processing Activities — a mandatory inventory of all personal data processing activities under GDPR Article 30.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes