How should teams choose a lawful basis under the UK GDPR?
Teams should treat Lawful Bases under the UK GDPR as a source-linked operating decision: confirm whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to identify the controller/processor role, purpose, lawful basis, special-category status, right, breach, transfer, or child-data trigger before assigning the UK GDPR action.
- Write the Lawful Bases decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
ICO guidance confirms Article 6 lawful bases and the need to choose at least one before handling personal information.
ICO principles guidance supports linking lawful basis decisions to fairness, transparency, accountability, and documented processing controls.
Directly supports the FAQ answer by tying processing decisions to Article 6 lawful-basis selection and evidence.