UK GDPR Lawful Bases

Start with the purpose, the controller's relationship with the person, and the legal or practical reason the processing is needed. Contract applies only where processing is objectively necessary to perform a contract with the person or take requested pre-contract steps. Legal obligation needs a duty imposed by UK law. Vital interests is narrow and protects a person's life. Public task requires a task in the public interest or official authority laid down by law.

Use consent only when the person has a genuine choice and can withdraw without detriment. Use ordinary legitimate interests only after the purpose, necessity, and balancing tests. Use recognised legitimate interest only when every requirement of a specific Annex 1 condition is met; unlike ordinary legitimate interests, it does not require a separate balancing test.

Article 6 is only the first layer. Processing special category data also needs an Article 9 condition. Processing criminal offence data must satisfy Article 10 and usually a condition in the Data Protection Act 2018. If the activity uses cookies or similar storage and access technologies, PECR may require consent even where another UK GDPR basis might otherwise appear available.

The selected basis also changes the rights analysis. For example, the right to data portability is tied to consent or contract and automated processing, while the right to object is particularly relevant to public task and legitimate interests. No lawful basis overrides fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, or accountability.

Keep a decision record that identifies the controller, data and people affected, each purpose, the chosen basis, the facts supporting it, the necessity analysis, and the approval date. Add the relevant contract clause, legal provision, consent record, public-task authority, Annex 1 condition, or legitimate interests assessment rather than relying on a label alone.

Update the record and privacy information when the purpose or processing changes. A controller should not switch basis after processing has started merely because the original choice became inconvenient. A genuine change in circumstances may justify a different basis, but the controller must document the change, assess fairness, and tell people where required.