Lawful basis
A lawful basis is the legal ground you rely on to use personal data for a particular purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests. You need one for every purpose, chosen before you start, and your privacy notice tells people which one applies.
- Clauses
- UK GDPR Article 6(1) · EU GDPR Article 6(1) · UK GDPR Article 6(1)(ea) · UK GDPR Annex 1
Where the term appears
UK GDPR Article 6(1) and EU GDPR Article 6(1) set out the six bases, and no basis ranks above another. Since 5 February 2026 the UK has a seventh, recognised legitimate interests (UK GDPR Article 6(1)(ea)), limited to the closed list of public-interest purposes in UK GDPR Annex 1, such as crime, emergencies and safeguarding, with no balancing test. Ordinary legitimate interests, direct marketing included, still need the balancing test. The lawful basis page walks through each basis.
Pick it first, keep it
Auditors and regulators look for the basis recorded per purpose before the processing began, in the record of processing and in the notice. Swapping bases later is the common failure: if your consent proves invalid, you cannot quietly fall back on legitimate interests for the same purpose. Consent is not the safe default either; where you would process the data anyway, consent is the wrong basis.
How Sted uses it
- Sted’s Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals’ rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.
- Sted’s knowledge base includes a Privacy Notice (NTC-PN) for customers and website users and an Employee Privacy Notice (NTC-EPN) for staff, each covering what is collected, why and on what lawful basis, who receives it, how long it is kept and people’s rights.
Related terms
- Personal data: what the basis covers.
- Special category data: needs an extra condition on top of a lawful basis.
- Records of processing activities (ROPA): where you record the basis for each activity.
- Controller and processor: the controller chooses the basis; a processor relies on the controller’s.