Lawful basis GDPR

Consent as a lawful basis

Consent as a lawful basis GDPR means that a person has freely, specifically, informedly and unambiguously given their approval to the processing of their personal data for one or more specified purposes. Once consent has been given, it must be as easy to withdraw it as it was to give it, and the person must be informed of this right before consent is obtained.

Consent must be an affirmative act and cannot be presumed through silence or inactivity. It is the controller’s responsibility to demonstrate that valid consent has been obtained.

Contract as a lawful basis

Contract is a lawful basis under the GDPR and means that processing of personal data is permitted when necessary to perform a contract to which the data subject is party. Contract as a legal basis also covers pre-contractual measures taken prior to entering into a contract when those measures are taken at the request of the data subject with a view to entering into a contract.

For example, a company may process a customer’s address to deliver goods ordered under a sales contract. This basis is common for transactions, employment relationships and service delivery where personal data processing is required to fulfil contractual obligations.

Legal obligation as a lawful basis

The controller may be under a legal obligation requiring the processing of personal data. This means the lawful basis of legal obligation applies to the extent the processing is necessary to comply with a duty arising from law, regulation or another legal requirement.

For example, an organisation may process personal data to meet bookkeeping obligations under accounting legislation. This basis applies where the controller is legally obliged to carry out the processing, and it cannot be used for voluntary undertakings. It must therefore be established how far the legal obligation extends; if this is unclear, another GDPR legal basis may need to be considered.

Protection of vital interests as a lawful basis

Personal data may be processed if necessary to protect the vital interests of the data subject or another person, particularly where the person is physically or legally unable to give consent. The lawful basis is then protection of vital interests, which is primarily relevant in emergencies — for example, where a person is unconscious and needs urgent medical care. Other legal bases should be considered before relying on protection of vital interests.

Public interest or exercise of official authority as a lawful basis

This lawful basis means processing is permitted when necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This applies primarily to public authorities but can also include private actors performing tasks in the public interest.

The processing must be supported by law, other legislation, a collective agreement or a decision made under statutory authority. An example would be processing of personal data in education, healthcare or other public services.

Legitimate interests as a lawful basis

Legitimate interests as a legal basis means an organisation may process personal data where its legitimate interest outweighs the data subject’s interests in privacy. The organisation must carry out a careful assessment balancing its legitimate interests against the individual’s rights and freedoms. Legitimate interests as a lawful basis differs from the other bases in that the controller must itself identify and weigh its own legitimate interest against the data subject’s interests.

Legitimate interests may, for example, be used for direct marketing, noting that the data subject has a right to object to receiving direct marketing. The balancing test must be documented, and the processing must be necessary to achieve the legitimate interest. Under any GDPR legal basis, the organisation must also ensure transparency and data minimisation.