Article 6 of the GDPR: Understanding the Legal Bases
.png)
DPO Consulting Joins Grant Thornton
Summary
GDPR Article 6 states a simple rule, processing is lawful only if at least one of the six conditions it lists is met. This provision is the entry point to the whole of compliance, because it settles the legality of processing before any question of security or retention arises.
In practice, two mistakes recur. The first is asking for consent for processing that actually rests on a contract or a legal obligation. The second is picking a basis after the fact, to justify processing already running in production. Both weaken the file in an inspection.
Article 6 of the GDPR, titled lawfulness of processing, provides that processing is lawful only if, and to the extent that, at least one of the six conditions it lists applies. It operationalises the lawfulness principle set in Article 5(1)(a), which requires processing to be lawful, fair and transparent.
Three provisions frame how it works. Member States may keep or introduce more specific rules for processing based on a legal obligation or a public interest task (Article 6(2)). For those two bases, the basis must be laid down in Union or Member State law (Article 6(3)). Article 6(4) then governs any change of purpose, listing the criteria of the compatibility test.
A legal basis is not chosen for an organisation, it is chosen for each purpose. The same company can process a customer's data on contract for delivery, on legal obligation for invoicing, and on legitimate interests for fraud prevention. Our guide to GDPR compliance places that logic in the wider framework.
The six legal bases under GDPR Article 6 are consent, contract, legal obligation, vital interests, public interest task and legitimate interests. They carry equal legal weight, none ranks above the others. The table below sets out each one with its reference and the situations where it genuinely applies.
Consent, under Article 6(1)(a), means the person has consented to the processing of their data for one or more specific purposes. It suits genuinely optional processing, newsletters, non-essential cookies, profile enrichment. Its weakness is structural, the person can withdraw at any moment, which means you have to be able to stop the processing.
Article 6(1)(b) covers processing necessary for the performance of a contract to which the person is party, or for pre-contractual steps taken at their request. The word necessary is strict. Delivering an order sits under contract, sending that same customer a promotional offer does not, however natural an extension of the relationship it feels.
Article 6(1)(c) covers processing necessary for compliance with a legal obligation to which the controller is subject. Retention of accounting records, payroll filings, anti-money-laundering duties. To rely on this basis you must be able to cite the specific instrument that imposes the processing, not a sector habit.
Article 6(1)(d) concerns processing necessary to protect the vital interests of the data subject or of another natural person. Its scope is narrow, covering life-or-death situations, a medical emergency involving an unconscious patient or a humanitarian crisis. It is never a fallback for ordinary processing.
Article 6(1)(e) covers processing necessary for a task carried out in the public interest or in the exercise of official authority. It applies to public bodies and to private organisations vested with such a task. As with legal obligation, the basis must be laid down in Union or Member State law.
Article 6(1)(f) permits processing necessary for the legitimate interests pursued by the controller or a third party, unless overridden by the interests or fundamental rights and freedoms of the person, in particular where that person is a child. Two points are routinely missed. This basis requires a documented balancing test carried out beforehand, and it does not apply to public authorities in the performance of their tasks.
GDPR consent is governed by precise conditions, set in Article 7 and completed by the definition in Article 4(11). Consent that fails them is not a valid legal basis, and the processing becomes unlawful. The five points below cover the questions teams ask before choosing this basis.
Consent applies where no other basis fits and the processing is genuinely optional for the person. It is also required by specific rules, notably for non-essential cookies under the ePrivacy regime and for special category data under Article 9, where consent must be explicit. Our article on the ePrivacy Directive covers that separate regime.
Consent must be freely given, specific, informed and unambiguous, expressed through a clear affirmative action. Article 7 adds four operational requirements, the controller must be able to demonstrate it, the request must be presented separately from other matters in plain language, withdrawal must be as easy as giving consent, and a service must not be made conditional on consent that is not necessary for that service.
Ordinary consent can come from a clear affirmative action, an actively ticked box for example. Explicit consent, required by Article 9(2)(a) for special category data, means an express statement, usually written and specific to the type of data involved. Confusing the two exposes health data processing to immediate challenge.
The person can withdraw at any time, and withdrawal must be as easy as giving consent. Withdrawal does not affect the lawfulness of processing carried out beforehand. Concretely, if consent was captured in two clicks, withdrawing it cannot require a registered letter. Our guide to GDPR data consent covers the accepted mechanisms.
No, and this is a frequent error. If the processing is necessary to perform the contract, the basis is the contract, not consent. Asking for consent in that situation creates an illusion of choice, since the person cannot refuse without losing the service, which strips the consent of its freely given character under Article 7(4).
Choosing a basis under GDPR Article 6 follows a five-step sequence, and the order matters. Starting from the basis you would prefer, then dressing the purpose to fit it, produces precisely the files that regulators reclassify on inspection.
A purpose is stated in one precise, verifiable, bounded sentence. Managing the customer relationship is not a purpose, it is a category. Delivering orders, handling complaints and sending promotional offers are three distinct purposes, each needing its own analysis.
Every basis except consent requires the processing to be necessary. Necessary does not mean useful or convenient, it means there is no less intrusive way to achieve the same purpose. If the purpose can be met with less data, the processing is not necessary as designed.
Work through the bases in a logical order rather than by preference. Does a legal obligation require the processing, is it necessary for the contract, does it fall under a public interest task, can it rest on legitimate interests after a balancing test. Consent comes last, where the processing is genuinely optional.
Documentation is what turns a GDPR legal basis into defensible evidence. Keep the purpose, the basis chosen, the reasoning applied, and for legitimate interests the full balancing assessment. Article 5(2) requires the controller to demonstrate compliance, not merely assert it.
The rights available to the person vary with the basis, something many organisations discover only when a request arrives. Our guide to data subject rights under GDPR sets out each right and its conditions.
The record is where the legal basis becomes defensible. One point is worth stating plainly, Article 30 does not expressly require the legal basis among the items of the record. The template published by the CNIL does include it, and the duty to demonstrate compliance makes it indispensable in practice.
It attaches to each processing entry, next to the purpose it justifies. A processing activity covering several purposes carries as many lines as it has distinct bases. Our guide to GDPR Article 30 and the record of processing activities describes the expected structure.
Attach the precise reference, the instrument imposing the processing for a legal obligation, the contract concerned for Article 6(1)(b), the balancing test for legitimate interests, and the capture and proof mechanism for consent. A basis listed without supporting material is no better than an empty field.
One column per element, one line per purpose, a date of last review. Illegible records are rarely short of content, they fail because several purposes are crushed into a single entry. Regulators report this defect repeatedly during inspections.
Any change of purpose triggers Article 6(4). Where further processing rests neither on consent nor on a legal provision, you must run the compatibility test, weighing the link between the purposes, the context of collection, the nature of the data, the possible consequences for the people concerned and the safeguards in place, such as encryption or pseudonymisation.
The basis chosen determines which rights people can exercise and which obligations fall on the organisation. That is why the choice cannot be treated as a record-keeping formality. The table below shows what actually changes from one basis to another.
Two consequences deserve particular attention. The right to object under Article 21 applies only to processing based on legitimate interests or on a public interest task. The right to data portability under Article 20 covers only processing based on consent or on a contract, and carried out by automated means.
The examples below cover the processing activities most common in business. They illustrate a single rule, the basis follows from the purpose and from whether the processing is necessary, never from convenience.
High-risk processing calls for an additional step. A data protection impact assessment is then required, and it builds directly on the legal basis chosen.
Four practices are enough to keep every GDPR legal basis solid over time. They share one objective, making the reasoning visible and dated, because an inspection examines evidence rather than intent.
The basis is settled at design time, not after go-live. Build the question into the scoping of every new project, alongside the purpose and the retention periods. Processing launched without an identified basis is unlawful from day one, even if nobody notices.
One purpose, one basis. As soon as a record entry bundles several purposes under a single basis, compliance becomes impossible to demonstrate. That split is also what lets you answer an objection or portability request correctly.
Proof of consent with a timestamp and the wording displayed, the reference of the legal instrument, a copy of the standard contract, a signed balancing test for legitimate interests. These must be retrievable without reconstruction, years later. The privacy policy must also state the legal basis for each purpose, as Article 13 requires.
Set an annual review, plus a review triggered by any new project, tool change or new purpose. Legal bases expire quietly, when a processing activity evolves and the record entry does not follow.
DPO Consulting has supported European and international organisations on GDPR compliance for more than ten years, with over 50 in-house experts. Work on legal bases is among the most structural, because it determines the validity of everything downstream, from the record to the answers given to rights requests.
To test how solid the legal bases behind your processing really are, start with a GDPR compliance audit, which reviews your purposes, your bases and your record. You can also talk to an expert at DPO Consulting before launching a sensitive new processing activity.
Where no other basis applies and the processing is genuinely optional for the person, and in cases where a specific rule imposes it, non-essential cookies and special category data in particular. Consent is not the default basis, it is the most demanding one to maintain over time.
GDPR consent is a freely given, specific, informed and unambiguous indication of the person's wishes by which they accept, through a clear affirmative action, the processing of their data for one or more defined purposes. A pre-ticked box, silence or blanket acceptance of terms and conditions does not amount to consent.
Switching basis mid-processing is strongly discouraged and rarely valid. If the original basis was wrong, the processing was unlawful, and moving to another basis does not cure the past. A change of purpose, by contrast, is governed by the Article 6(4) compatibility test.
Where the interest pursued is real and lawful, the processing is necessary to achieve it, and the balancing test shows that the person's interests and freedoms do not override it. This basis is closed to public authorities acting in the performance of their tasks, under the final sub-paragraph of Article 6(1).
Article 6(1)(b), provided the processing is objectively necessary to perform the contract or to take pre-contractual steps requested by the person. Processing that is merely useful to the controller, such as advertising personalisation, falls under a different basis.
The processing cannot go ahead as designed. Two routes exist, redefine the purpose so that it matches a valid basis, or cut the processing back until it becomes necessary under an identified basis. Looking for a basis afterwards is not a defensible position in an inspection.
.png)
.svg)
.png)
%20(1).png)
