Legal Bases for the Processing of Personal Data Under the GDPR: 6 Bases and Practical Examples
The processing of personal data must be based on at least one of the legal grounds set forth in the General Data Protection Regulation (GDPR). An organization cannot process personal data simply because it needs it—the legal basis for such processing must be established before processing begins.
In practice, selecting the appropriate legal basis is one of the most important aspects of personal data protection. The chosen basis can determine the organization’s obligations, the rights of the data subject, and what additional steps must be taken.
What is the legal basis for processing personal data?
The legal basis for the processing of personal data is a condition established by the GDPR under which an organization may lawfully process personal data. Before beginning to process personal data, an organization should determine the specific purpose of the processing and assess which of the grounds set forth in Article 6 of the GDPR may serve as the basis for such processing.
Under Article 6(1) of the GDPR, the processing of personal data is lawful if at least one of the conditions set forth therein applies. Different legal bases may apply to different data processing purposes within the same organization; therefore, it is important to assess each data processing activity separately.
The organization should also be able to justify why that particular legal basis was chosen for a specific data processing activity.
6 Legal Bases for the Processing of Personal Data Under the GDPR
1. Consent of the Data Subject
Consent is one of the legal bases for the processing of personal data provided for in the GDPR. For consent to be valid, it must be freely given, specific, informed, and unambiguous. The data subject must understand what data processing they are consenting to.
For example, a company may ask a customer for consent to receive direct marketing messages via email. However, consent should not be used in cases where data processing is necessary for the performance of a contract or where the organization is subject to a legal obligation.
The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.
2. Performance of the Contract
Personal data may be lawfully processed when it is necessary to fulfill a contract with the data subject or to take steps prior to entering into a contract, provided that such processing is carried out at the request of the data subject.
For example, when providing services to a customer, a company may process the customer’s first name, last name, contact information, and other information necessary to conclude or perform a contract.
However, not all data that an organization might wish to collect about a customer automatically becomes necessary for the performance of a contract. It is necessary to assess whether the specific processing of data is in fact necessary for the performance of the contract.
3. Compliance with Legal Obligations
The processing of personal data may be lawful when it is necessary for the data controller to comply with a legal obligation to which it is subject. In such cases, the basis for data processing is not the data subject’s consent, but rather a specific legal obligation imposed on the organization by law.
For example, a company may be required to process certain data of employees, customers, or other individuals in accordance with the requirements of tax, accounting, labor law, or other areas of law.
An organization should be able to determine which law and which specific legal obligation necessitates the processing of the relevant personal data.
4. Protection of Vital Interests
Personal data may be processed when necessary to protect the vital interests of the data subject or another natural person.
This legal basis is applied relatively rarely in practice and is primarily relevant in situations where it is necessary to protect a person’s life or prevent serious harm. For example, in the case of emergency medical care, it may be necessary to process a person’s data when the person is unable to adequately express their will.
The ground of protection of vital interests should not be used as a general or convenient basis for an organization’s routine activities.
5. The public interest or the exercise of public authority functions
The processing of personal data may be lawful when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
This basis is most often relevant to public sector institutions and organizations that perform functions established by law. The relevant task or function must be based on European Union or Member State law.
A private entity may also process personal data on this basis in certain cases, but there must be an appropriate legal basis and an element of public interest.
6. Legitimate Interests
The processing of personal data may be based on the legitimate interests of the data controller or a third party, provided that such processing is necessary to pursue a legitimate interest and is not overridden by the interests, rights, and freedoms of the data subject.
In practice, legitimate interests may be relevant, for example, the protection of assets or information systems, the prevention of fraud, certain forms of direct marketing, the assertion or defense of legal claims, and ensuring the security of an organization’s IT systems.
However, simply stating that data is processed on the basis of “legitimate interests” is not sufficient. The organization should assess whether the interest is legitimate, whether the processing is necessary, and whether the organization’s interests are not outweighed by the data subject’s rights and freedoms. In practice, such an assessment is often carried out using a balancing test of legitimate interests.
How do you choose the right legal basis for data processing?
Selecting the appropriate legal basis for processing personal data should begin with determining the specific purpose of the data processing. The organization should assess what personal data is being processed, why it is necessary, and under what circumstances the processing takes place.
In practice, the following should be determined:
- what personal data is processed;
- for what purpose they are processed;
- whether the processing of data is necessary;
- whether there is a specific legal obligation;
- whether the processing of data is related to the performance of a contract;
- whether another basis set forth in Article 6 of the GDPR may be applied.
It is important to select the legal basis for processing personal data before beginning the processing and to be able to justify why that particular basis was chosen for the specific processing activity.
Consent and Legitimate Interests—How Do They Differ?
Consent and legitimate interests are two distinct legal bases for the processing of personal data. The processing of personal data based on consent depends on the data subject’s freely given consent, whereas, based on legitimate interests, an organization may process data without consent if the conditions set forth in the GDPR are met.
Consent must be freely given, specific, informed, and unambiguous, and the data subject must have the option to withdraw it at any time. Meanwhile, when relying on legitimate interests, it is necessary to assess the organization’s interest, the necessity of processing personal data, and the balance between the data subject’s interests and rights.
Therefore, simply because it would be easier to obtain consent, it should not be chosen as the legal basis in cases where data processing is in fact based on another basis set forth in the GDPR.
Is it possible to change the legal basis for processing personal data?
The legal basis must correspond to the actual purpose and circumstances of the data processing. An organization should not arbitrarily substitute one basis for another simply to avoid the requirements applicable to a specific basis.
If the purpose, circumstances, or legal basis for the processing of personal data changes, the organization should reassess the lawfulness of the data processing and, where applicable, update the information provided to data subjects.
Therefore, the legal basis for the lawful processing of personal data should not be viewed as a mere formality in a privacy policy. It must be grounded in the specific circumstances of the data processing and correspond to the organization’s actual activities.
Common Mistakes When Choosing a Legal Basis for Data Processing
In practice, organizations most often encounter several recurring mistakes:
Consent is selected automatically.
Sometimes consent is requested even when data processing is necessary for the performance of a contract or arises from a legal obligation.
Legitimate interests are stated without proper assessment.
Simply stating “legitimate interests” in a privacy policy is not enough. The specific interest, the necessity of the data processing, and the balance between the interests and rights of the data subject must be assessed.
Excess data is being processed.
Even when there is a legitimate basis, an organization should not collect more personal data than is necessary to achieve the specified purpose.
Different purposes of data processing cannot be combined.
A single legal basis may be appropriate for one purpose of data processing but not for another.
There is no explanation as to why a specific basis was chosen.
The organization should be able to justify its choice and, when necessary, document it.
What should an organization do if it is unsure about the lawfulness of its data processing?
If it is unclear on what basis an organization may lawfully process personal data, the specific data processing operation, its purpose, and the circumstances should be assessed first.
It is necessary to determine what data is being processed, why it is needed, to whom it is disclosed, and which legal basis set forth in Article 6 of the GDPR may apply. If the data processing is based on legitimate interests, a more detailed assessment of those legitimate interests may be necessary.
If special categories of personal data are being processed, the conditions set forth in Article 9 of the GDPR must also be assessed. The appropriate selection of a legal basis should be integrated into the organization’s data protection processes and documentation.
Do you need legal assistance regarding the processing of personal data?
Selecting the appropriate legal basis for the lawful processing of personal data is an important part of GDPR compliance. LEAGUS advises companies and organizations on the processing of personal data, the selection of legal bases, the assessment of legitimate interests, and other data protection issues.
Learn more about personal data protection services →
This article was written by
Tadas Kuzminskas
Partner, Attorney