Lawful Bases decisions under the UK GDPR should name the exact basis, explain why it fits the processing, and record the evidence that supports the choice.
Article 6 now contains the six familiar bases plus the UK-specific recognised legitimate interests route for the closed Annex 1 conditions. Keep that route separate from ordinary legitimate interests and complete any Article 9 or 10 analysis.
Article 6 now contains the six familiar bases - consent, contract, legal obligation, vital interests, public task, and ordinary legitimate interests - plus the UK-specific recognised legitimate interests basis inserted by the Data (Use and Access) Act 2025 and in force from 5 February 2026. The new basis is not a general shortcut: the processing must be necessary for a condition listed in Annex 1. Special-category or criminal-offence data still needs the separate Article 9 or 10 analysis.
1
Section 1
Which Article 6 basis fits the purpose?
Define the purpose first, then test necessity. Consent requires a real choice and valid, demonstrable agreement. Contract covers processing objectively necessary to perform a contract with the person or take requested pre-contract steps, not everything written into terms. Legal obligation requires a duty under law, not a contract. Vital interests normally protects someone's life and is generally reserved for life-or-death interests. Public task requires a task in the public interest or official authority with a clear basis in law.
Ordinary legitimate interests requires a three-part assessment: identify a legitimate purpose, show the processing is necessary, and balance it against the person's interests, rights, and freedoms. Public authorities cannot use it for processing carried out in performing their public tasks. Direct marketing may be a legitimate interest, but PECR consent rules can still apply and people have an absolute right to object to direct marketing.
under Article 6(1)(ea) is a separate UK basis. It applies only where processing is necessary for a condition in Annex 1, covering specified public-task disclosures, national or public security and defence, emergencies, crime, and safeguarding vulnerable people. It removes the ordinary balancing test for those closed conditions, but does not remove necessity, fairness, transparency, data minimisation, security, rights, or any other UK GDPR duty.
Record one purpose at a time; different purposes for the same data may need different bases.
Do not default to consent where refusal or withdrawal would not be a genuine choice, or where the processing is objectively necessary for another basis.
Do not repair invalid consent by switching retrospectively to another basis. Stop or restrict the processing, assess the correct basis on the current facts, and document any lawful prospective use.
For legal obligation or public task, identify the law, function, power, or duty and how it authorises or requires the processing.
For ordinary legitimate interests, keep the purpose, necessity, and balancing assessment with the processing record.
For , record the exact Annex 1 condition and each condition-specific requirement.
Do not use for a significant decision based solely on automated processing; identify another permitted basis and apply the safeguards required by Articles 22A to 22D.
Binding Article 6 and Annex 1 conditions, plus the principles and rights that continue to apply.
2
Section 2
When is recognised legitimate interest available?
The public-task disclosure response condition can support a voluntary disclosure requested by an organisation that needs the information for a public task or official function. The requester must provide the information required by Annex 1. If disclosure is legally required, legal obligation is the likely Article 6 basis instead.
The other Annex 1 conditions address necessary processing for national security, public security or defence; responding to emergencies; detecting, investigating, or preventing crime or apprehending or prosecuting offenders; and safeguarding a child or an adult at risk. Apply the definitions and safeguards in the relevant condition rather than relying on the category name alone.
A public authority cannot use for processing in the performance of its own tasks. The basis is not an exemption and does not automatically supply an Article 9 condition for special category data or an Article 10 route for criminal-offence data. For example, a company responding voluntarily to a properly framed police request may be able to use the public-task disclosure condition; the police's own processing still needs its own lawful route.
Keep the request, requester identity, stated public task or official function, data requested, necessity analysis, and disclosure decision.
For safeguarding, record how the person meets the relevant child or adult-at-risk definition and why the processing is necessary.
For emergencies, record the event, threatened harm, urgency, data used, recipients, and why ordinary routes were insufficient.
Do not relabel routine fraud prevention, commercial risk, or general safety work without checking every requirement of the crime, security, or safeguarding condition.
Official explanation of Article 6(1)(ea), Article 6(5), and the Annex 1 recognised-legitimate-interest conditions.
3
Section 3
What additional conditions and rights must be checked?
Article 6 is only the first layer. Special category data needs an Article 9 condition and, for several UK conditions, a matching Data Protection Act 2018 Schedule 1 condition. Some Schedule 1 conditions require an appropriate policy document. Criminal-offence data needs Article 10 authority through official control or domestic law, including applicable Schedule 1 conditions.
The chosen basis changes some individual rights. Portability generally applies to automated processing based on consent or contract. The general right to object applies to public task, , and ordinary legitimate interests, while direct-marketing objections are absolute. Erasure is limited for legal-obligation and public-task processing. Withdrawal ends consent-based processing prospectively but does not undo processing that was lawful before withdrawal.
If a purpose changes, assess compatibility and whether the existing basis still fits. Consent for the old purpose does not cover a new incompatible purpose. A new legal obligation may supply a new basis; otherwise document the compatibility analysis and update privacy information before further processing where required.
Map Article 6, Article 9 or 10, Schedule 1, policy-document, transparency, rights, and retention decisions together.
Check PECR separately for cookies, storage and access technologies, and electronic marketing.
Check whether automated decisions, children, vulnerable people, or high-risk processing require additional safeguards or a DPIA.
Do not use a processor contract or international-transfer instrument as the lawful basis for the underlying processing.
Binding UK provisions and Schedule 1 conditions supplementing Articles 9 and 10.
4
Section 4
What should the lawful-basis record contain?
The controller should approve the purpose and lawful basis before processing starts. Product, operations, HR, marketing, or another business owner supplies the facts; privacy or legal reviewers test the conditions; engineering and vendors confirm what the system actually does. A processor follows the controller's documented instructions but must identify its own basis for processing outside those instructions.
For each purpose, keep the data subjects and categories, controller role, exact Article 6 basis, necessity analysis, supporting law or assessment, Article 9 or 10 route, Schedule 1 condition and policy document where required, rights impact, privacy-notice text, recipients, retention, systems, owner, approver, decision date, and review trigger.
Review the basis when the purpose, data, people, relationship, technology, recipients, legal authority, or choice offered to the person changes.
For consent, keep what the person was told, the affirmative action, purposes selected, timestamp, version, and withdrawal mechanism.
For contract, identify the requested service or pre-contract step and explain why it cannot reasonably be performed without the processing.
For legitimate interests, retain the completed assessment and reflect the interest in privacy information.
Update the record and privacy information before relying on a materially different purpose or basis.
ICO guidance on records of processing and the evidence needed to demonstrate accountability.
Recommended next step
Choose and document the lawful basis
Record the specific purpose, necessity test, Article 6 basis, any Article 9 or 10 route, affected rights, notice wording, approver, and change trigger before processing starts.