{"id":7150,"date":"2026-08-10T12:52:12","date_gmt":"2026-08-10T09:52:12","guid":{"rendered":"https:\/\/leagus.lt\/legal-bases-for-the-processing-of-personal-data-under-the-gdpr-6-bases-and-practical-examples\/"},"modified":"2026-10-04T13:12:54","modified_gmt":"2026-10-04T10:12:54","slug":"legal-bases-for-the-processing-of-personal-data-under-the-gdpr-6-bases-and-practical-examples","status":"publish","type":"post","link":"https:\/\/leagus.lt\/en\/legal-bases-for-the-processing-of-personal-data-under-the-gdpr-6-bases-and-practical-examples\/","title":{"rendered":"Legal Bases for the Processing of Personal Data Under the GDPR: 6 Bases and Practical Examples"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The processing of personal data must be based on at least one of the legal grounds set forth in the General Data Protection Regulation (GDPR). An organization cannot process personal data simply because it needs it\u2014the legal basis for such processing must be established before processing begins.
In practice, selecting the appropriate legal basis is one of the most important aspects of personal data protection. The chosen basis can determine the organization\u2019s obligations, the rights of the data subject, and what additional steps must be taken. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

What is the legal basis for processing personal data?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The legal basis for the processing of personal data is a condition established by the GDPR under which an organization may lawfully process personal data. Before beginning to process personal data, an organization should determine the specific purpose of the processing and assess which of the grounds set forth in Article 6 of the GDPR may serve as the basis for such processing.
Under Article 6(1) of the GDPR, the processing of personal data is lawful if at least one of the conditions set forth therein applies. Different legal bases may apply to different data processing purposes within the same organization; therefore, it is important to assess each data processing activity separately.
The organization should also be able to justify why that particular legal basis was chosen for a specific data processing activity. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

6 Legal Bases for the Processing of Personal Data Under the GDPR<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

1. Consent of the Data Subject<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Consent is one of the legal bases for the processing of personal data provided for in the GDPR. For consent to be valid, it must be freely given, specific, informed, and unambiguous. The data subject must understand what data processing they are consenting to.
For example, a company may ask a customer for consent to receive direct marketing messages via email. However, consent should not be used in cases where data processing is necessary for the performance of a contract or where the organization is subject to a legal obligation.
The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

2. Performance of the Contract<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Personal data may be lawfully processed when it is necessary to fulfill a contract with the data subject or to take steps prior to entering into a contract, provided that such processing is carried out at the request of the data subject.
For example, when providing services to a customer, a company may process the customer\u2019s first name, last name, contact information, and other information necessary to conclude or perform a contract.
However, not all data that an organization might wish to collect about a customer automatically becomes necessary for the performance of a contract. It is necessary to assess whether the specific processing of data is in fact necessary for the performance of the contract. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

3. Compliance with Legal Obligations<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The processing of personal data may be lawful when it is necessary for the data controller to comply with a legal obligation to which it is subject. In such cases, the basis for data processing is not the data subject\u2019s consent, but rather a specific legal obligation imposed on the organization by law.
For example, a company may be required to process certain data of employees, customers, or other individuals in accordance with the requirements of tax, accounting, labor law, or other areas of law.
An organization should be able to determine which law and which specific legal obligation necessitates the processing of the relevant personal data. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

4. Protection of Vital Interests<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Personal data may be processed when necessary to protect the vital interests of the data subject or another natural person.
This legal basis is applied relatively rarely in practice and is primarily relevant in situations where it is necessary to protect a person\u2019s life or prevent serious harm. For example, in the case of emergency medical care, it may be necessary to process a person\u2019s data when the person is unable to adequately express their will.
The ground of protection of vital interests should not be used as a general or convenient basis for an organization\u2019s routine activities. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

5. The public interest or the exercise of public authority functions<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The processing of personal data may be lawful when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
This basis is most often relevant to public sector institutions and organizations that perform functions established by law. The relevant task or function must be based on European Union or Member State law.
A private entity may also process personal data on this basis in certain cases, but there must be an appropriate legal basis and an element of public interest. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

6. Legitimate Interests<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The processing of personal data may be based on the legitimate interests of the data controller or a third party, provided that such processing is necessary to pursue a legitimate interest and is not overridden by the interests, rights, and freedoms of the data subject.<\/p>

In practice, legitimate interests may be relevant, for example, the protection of assets or information systems, the prevention of fraud, certain forms of direct marketing, the assertion or defense of legal claims, and ensuring the security of an organization\u2019s IT systems.<\/p>

However, simply stating that data is processed on the basis of \u201clegitimate interests\u201d is not sufficient. The organization should assess whether the interest is legitimate, whether the processing is necessary, and whether the organization\u2019s interests are not outweighed by the data subject\u2019s rights and freedoms. In practice, such an assessment is often carried out using a balancing test of legitimate interests<\/strong>. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

How do you choose the right legal basis for data processing?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Selecting the appropriate legal basis for processing personal data should begin with determining the specific purpose of the data processing. The organization should assess what personal data is being processed, why it is necessary, and under what circumstances the processing takes place. <\/p>

In practice, the following should be determined:<\/p>