GDPR Article 6 Legal Bases

Article 6(1) GDPR lists six lawful bases: consent for one or more specific purposes; necessity for a contract with the data subject or pre-contract steps requested by the data subject; necessity for a legal obligation that applies to the controller; necessity to protect vital interests; necessity for a public-interest task or official authority vested in the controller; and necessity for legitimate interests pursued by the controller or a third party, unless overridden by the data subject's interests or fundamental rights and freedoms.

Pick the basis for the specific purpose, not for the system as a whole. A product may rely on contract for processing objectively necessary to deliver the requested service, legal obligation for records required by law, consent for optional communications, and legitimate interests for a separate operational purpose if the necessity and balancing tests support it.

Consent must be freely given, specific, informed, and unambiguous, and Article 7 requires the controller to demonstrate consent. It must be as easy to withdraw as to give, and withdrawal does not invalidate processing that was lawful before withdrawal.

Consent is weak where the person has no real choice, the request is bundled into terms, the service is conditional on unnecessary processing, or there is a power imbalance. The EDPB guidance calls out public-authority and employment contexts as situations where consent will often be difficult to rely on because free choice may be limited.

Article 6(1)(f) is available where processing is necessary for legitimate interests pursued by the controller or a third party, unless those interests are overridden by the data subject's interests or fundamental rights and freedoms. The GDPR text specifically highlights protection of children in this balancing exercise.

A useful legitimate-interest record separates three questions: what legitimate interest is pursued, why the processing is necessary for that interest, and why the data subject's interests, rights, and freedoms do not override it. The record should also identify privacy notice text, objection handling, safeguards, and the review trigger.

Article 6(1)(c) covers processing necessary for compliance with a legal obligation to which the controller is subject. Article 6(1)(e) covers processing necessary for a public-interest task or official authority vested in the controller.

Both bases need support in Union or Member State law. Article 6(3) says that the purpose must be determined in that legal basis, or for public task must be necessary for the public-interest task or official authority, and that the law must meet an objective of public interest and be proportionate to the legitimate aim pursued.

Article 6 lawfulness is not the whole analysis when special-category data is involved. Article 9 separately prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation unless an Article 9(2) condition applies.

A controller processing special-category data needs both an Article 6 lawful basis and an Article 9(2) condition. Explicit consent under Article 9(2)(a) is one possible condition, but Article 9 includes others and notes that Union or Member State law may prevent consent from lifting the prohibition in specified cases. Personal data about criminal convictions and offences is governed separately by Article 10, not by the Article 9 special-category list.