Lawful basis for processing

UK GDPR Article 6 requires a lawful basis for each purpose you use personal data for: consent, contract, legal obligation, vital interests, public task or legitimate interests. The UK added a seventh, recognised legitimate interests, from 5 February 2026. Special category data also needs a condition under Article 9. EU GDPR has the same articles, without the UK addition.

The requirement in plain English

You must have a lawful basis before you start processing, for every purpose, and you must be able to say which one (UK GDPR Article 6(1), and the same article in EU GDPR). The six common to both regimes are:

Consent: the person has agreed, freely and specifically, and can withdraw at any time by a route as simple as the one they used to agree.
Contract: you need the data to perform a contract with the person, or to take steps they asked for before one.
Legal obligation: a law requires the processing, such as payroll records for tax.
Vital interests: the processing protects someone’s life.
Public task: you carry out a task in the public interest or an official function set out in law.
Legitimate interests: the processing is necessary for your interest or a third party’s, and the person’s interests do not override it (UK GDPR Article 6(1)(f)). Public authorities cannot use it for their core tasks.

No basis ranks above another. The right one is the one that fits the purpose, and you tell people which you rely on in your privacy notice (UK GDPR Article 13(1)). Where you rely on consent, you must be able to prove it was given (UK GDPR Article 7(1)).

Some data needs a second key. Special category data is off limits unless one of the conditions in UK GDPR Article 9(2) also applies, such as explicit consent, employment law duties or health care. Criminal offence data has its own rule (UK GDPR Article 10).

UK GDPR

The UK adds a seventh basis, recognised legitimate interests (UK GDPR Article 6(1)(ea)). It covers a closed list in Annex 1 to the UK GDPR: answering a request from a body carrying out a public task, national security and defence, emergencies, crime, and safeguarding children or adults at risk. For those purposes you do not run the balancing test, though people can still object (UK GDPR Article 21). Most special category and criminal offence conditions sit in Data Protection Act 2018 schedule 1, and many of them require an appropriate policy document. Online services offered directly to children can rely on a child’s own consent from age 13 (UK GDPR Article 8).

EU GDPR

The EU has the six bases only. Special category data needs a condition in EU GDPR Article 9(2), and several of those conditions depend on the member state’s own law, such as the employment rules in national data protection acts. Online services offered directly to children can rely on a child’s consent from 16, or a lower age between 13 and 16 that a member state sets (EU GDPR Article 8).

This is guidance to help you understand the requirement, not legal advice.

What good looks like

Picture a 30-person software company with a part-time privacy lead, usually the operations manager. Every processing activity in its record of processing carries a lawful basis column, filled in when the activity was designed rather than after a complaint.

Each activity that rests on legitimate interests has a written assessment of one or two pages: the purpose, why the processing is necessary for it, and the balance against the people affected, with the safeguards that tip it. The privacy lead reviews each one once a year and whenever the processing changes.

Marketing consent is logged by the tool that collects it: who agreed, when, to what wording, and how they withdraw. Staff data rests on contract and legal obligation, with sickness absence records covered by the employment condition and an appropriate policy document the privacy lead reviews annually.

The privacy notice lists each purpose with its basis, and the same wording appears in the record of processing, so the two never drift apart.

Evidence an auditor expects

Record of processing with a basis per activity: the auditor checks every activity has one; Article 30 does not list it as a field, but regulators expect it and ask for it first.
Consent records: required where consent is the basis; the auditor samples entries for date, wording and a working withdrawal route.
Legitimate interests assessments: usual rather than mandated in the text; the auditor checks the balancing was done before the processing began.
Appropriate policy document: required in the UK for many schedule 1 conditions; the auditor checks it names the conditions, retention and erasure, and is current.
Privacy notices: required; the auditor compares the bases named in the notice with those in the record.
Contracts and legal references: usual; they show the contract or law each “contract” or “legal obligation” activity relies on.

Common mistakes

Teams pick consent because it sounds safest, then discover they cannot carry on when someone withdraws, or that staff consent was never free. Choose consent only where the person has a real choice and you would stop if they said no.

Changing the basis after the fact

When consent turns out to be invalid, some organisations switch to legitimate interests. Regulators treat that as unfair, because people were told something else. Decide the basis at design time, and record a fallback only if you told people about it.

Legitimate interests with no written balance

Relying on legitimate interests without a recorded assessment leaves you nothing to show when someone objects. Write the three parts down before the processing starts; a page is enough for most activities.

Forgetting the second condition

Sickness notes, accessibility needs and fingerprint clock-in systems all involve special category data. A lawful basis alone does not cover them; record the Article 9 condition too, and in the UK the policy document that goes with it.

Reading recognised legitimate interests as a general shortcut

The UK’s seventh basis covers a short list of public-interest purposes. It does not cover marketing, analytics or fraud screening for your own business; those stay under ordinary legitimate interests, with the balancing test.

How Sted helps

Sted’s Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals’ rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.
For UK GDPR and for EU GDPR Sted’s knowledge base carries 34 policies, procedures and notices and 35 record templates each, led by the Personal Data Protection Policy, the Data Subject Rights Handling Policy, the Data Retention and Erasure Policy and the two privacy notices.
Each recommended requirement names the standards it helps you meet, with their clauses on hover; one with no clause tag reads Recommended.
Sted drafts your policies and procedures from its knowledge base, adapted to your organisation, for you to review.

Sted does not choose a lawful basis for you. You decide the basis for each processing activity and record it, with the reasoning behind it.

UK GDPR and EU GDPR: how lawful basis fits with the rest of the regulation.
Transparency and privacy notices: where you tell people which basis you rely on.
Records of processing activities: where each activity’s basis is written down.
Lawful basis: the term defined in one paragraph.
Data (Use and Access) Act 2025 changes: the UK’s recognised legitimate interests in context.
Documents: where your Personal Data Protection Policy lives once drafted.

Frequently asked questions

Can an employer rely on consent for staff data?

Rarely. Consent must be freely given, and the imbalance of power between employer and employee usually means it is not. Most staff processing rests on contract or legal obligation, with legitimate interests for things like building security, and consent kept for genuinely optional extras such as a photo on the website.

Is direct marketing a legitimate interest?

It can be. The UK GDPR names direct marketing as an example of a purpose that may be a legitimate interest, but you still run the three-part test, and electronic marketing also has to meet the separate consent rules for email and texts. In the EU the same position comes from EU GDPR Recital 47.