Article 6 GDPR: The Six Lawful Grounds for Lawful Processing
Article 6 GDPR establishes an exhaustive list of six lawful grounds. Personal data processing is only lawful if it relies on at least one of these bases. Identifying the correct basis prior to processing is mandatory.
1. The 6 Lawful Bases for Processing (Art. 6.1)
For personal data processing to be lawful under European Union law, the controller must establish that at least one of the six alternative legal grounds listed under Article 6(1) applies:
- a) Consent (Art. 6.1.a & Art. 7): Freely given, specific, informed and unambiguous agreement by the data subject. Consent may be withdrawn at any time as easily as it was given.
- b) Performance of a contract (Art. 6.1.b): Processing is strictly necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract.
- c) Legal obligation (Art. 6.1.c): Processing is necessary for compliance with a legal obligation to which the controller is subject under EU or Member State law (e.g., tax, social security, invoicing).
- d) Vital interests (Art. 6.1.d): Processing is necessary in order to protect the vital interests of the data subject or of another natural person (medical emergencies, life-threatening scenarios).
- e) Public task / Official authority (Art. 6.1.e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- f) Legitimate interests (Art. 6.1.f): Necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where overridden by the fundamental rights and freedoms of the data subject (inapplicable to public authorities performing their statutory tasks).
2. Accountability & The Strict Necessity Test
The legal basis must be identified and documented prior to starting the processing. Switching legal bases retrospectively (e.g., attempting to invoke legitimate interest after consent has been withdrawn) is prohibited under EDPB doctrine.
Regarding legitimate interests (Art. 6.1.f), the Court of Justice of the EU ruled in Case C-621/22 (KNLTB) that purely commercial interests are not automatically excluded, but strict necessity and a genuine balancing test (LIA) are legally indispensable.