Lawful Basis

A lawful basis is the legal justification an organization relies on to process personal data under the GDPR.

Article 6 of the GDPR identifies several lawful bases, including consent, contractual necessity, legal obligation, vital interests, public task, and legitimate interests.

The appropriate lawful basis depends on the purpose and circumstances of the processing.

Organizations should determine and document the lawful basis before processing begins and communicate the relevant information to data subjects through appropriate privacy notices.