# Lawful basis

The legal ground, one of six under EU GDPR and seven under UK GDPR, that you must have for each purpose you use personal data for.

Source: https://sted.digital/docs/glossary/lawful-basis · Last reviewed 17 October 2026 · Strand Glossary

A lawful basis is the legal ground you rely on to use personal data for a particular purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests. You need one for every purpose, chosen before you start, and your privacy notice tells people which one applies.

## Where the term appears

UK GDPR Article 6(1) and EU GDPR Article 6(1) set out the six bases, and no basis ranks above another. Since 5 February 2026 the UK has a seventh, recognised legitimate interests (UK GDPR Article 6(1)(ea)), limited to the closed list of public-interest purposes in UK GDPR Annex 1, such as crime, emergencies and safeguarding, with no balancing test. Ordinary legitimate interests, direct marketing included, still need the balancing test. The [lawful basis page](/docs/standards/gdpr/lawful-basis) walks through each basis.

### Pick it first, keep it

Auditors and regulators look for the basis recorded per purpose before the processing began, in the record of processing and in the notice. Swapping bases later is the common failure: if your consent proves invalid, you cannot quietly fall back on legitimate interests for the same purpose. Consent is not the safe default either; where you would process the data anyway, consent is the wrong basis.

## How Sted uses it

Sted's Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals' rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.
Sted's knowledge base includes a Privacy Notice (NTC-PN) for customers and website users and an Employee Privacy Notice (NTC-EPN) for staff, each covering what is collected, why and on what lawful basis, who receives it, how long it is kept and people's rights.

## Related terms

- [Personal data](/docs/glossary/personal-data): what the basis covers.
- [Special category data](/docs/glossary/special-category-data): needs an extra condition on top of a lawful basis.
- [Records of processing activities (ROPA)](/docs/glossary/records-of-processing): where you record the basis for each activity.
- [Controller and processor](/docs/glossary/controller-and-processor): the controller chooses the basis; a processor relies on the controller's.