UK GDPR Lawful Bases

Define the purpose first, then test necessity. Consent requires a real choice and valid, demonstrable agreement. Contract covers processing objectively necessary to perform a contract with the person or take requested pre-contract steps, not everything written into terms. Legal obligation requires a duty under law, not a contract. Vital interests normally protects someone's life and is generally reserved for life-or-death interests. Public task requires a task in the public interest or official authority with a clear basis in law.

Ordinary legitimate interests requires a three-part assessment: identify a legitimate purpose, show the processing is necessary, and balance it against the person's interests, rights, and freedoms. Public authorities cannot use it for processing carried out in performing their public tasks. Direct marketing may be a legitimate interest, but PECR consent rules can still apply and people have an absolute right to object to direct marketing.

Recognised legitimate interest under Article 6(1)(ea) is a separate UK basis. It applies only where processing is necessary for a condition in Annex 1, covering specified public-task disclosures, national or public security and defence, emergencies, crime, and safeguarding vulnerable people. It removes the ordinary balancing test for those closed conditions, but does not remove necessity, fairness, transparency, data minimisation, security, rights, or any other UK GDPR duty.

The public-task disclosure response condition can support a voluntary disclosure requested by an organisation that needs the information for a public task or official function. The requester must provide the information required by Annex 1. If disclosure is legally required, legal obligation is the likely Article 6 basis instead.

The other Annex 1 conditions address necessary processing for national security, public security or defence; responding to emergencies; detecting, investigating, or preventing crime or apprehending or prosecuting offenders; and safeguarding a child or an adult at risk. Apply the definitions and safeguards in the relevant condition rather than relying on the category name alone.

A public authority cannot use recognised legitimate interest for processing in the performance of its own tasks. The basis is not an exemption and does not automatically supply an Article 9 condition for special category data or an Article 10 route for criminal-offence data. For example, a company responding voluntarily to a properly framed police request may be able to use the public-task disclosure condition; the police's own processing still needs its own lawful route.

Article 6 is only the first layer. Special category data needs an Article 9 condition and, for several UK conditions, a matching Data Protection Act 2018 Schedule 1 condition. Some Schedule 1 conditions require an appropriate policy document. Criminal-offence data needs Article 10 authority through official control or domestic law, including applicable Schedule 1 conditions.

The chosen basis changes some individual rights. Portability generally applies to automated processing based on consent or contract. The general right to object applies to public task, recognised legitimate interest, and ordinary legitimate interests, while direct-marketing objections are absolute. Erasure is limited for legal-obligation and public-task processing. Withdrawal ends consent-based processing prospectively but does not undo processing that was lawful before withdrawal.

If a purpose changes, assess compatibility and whether the existing basis still fits. Consent for the old purpose does not cover a new incompatible purpose. A new legal obligation may supply a new basis; otherwise document the compatibility analysis and update privacy information before further processing where required.

The controller should approve the purpose and lawful basis before processing starts. Product, operations, HR, marketing, or another business owner supplies the facts; privacy or legal reviewers test the conditions; engineering and vendors confirm what the system actually does. A processor follows the controller's documented instructions but must identify its own basis for processing outside those instructions.

For each purpose, keep the data subjects and categories, controller role, exact Article 6 basis, necessity analysis, supporting law or assessment, Article 9 or 10 route, Schedule 1 condition and policy document where required, rights impact, privacy-notice text, recipients, retention, systems, owner, approver, decision date, and review trigger.