Article 6 GDPR: The Six Lawful Grounds for Lawful Processing

1. The 6 Lawful Bases for Processing (Art. 6.1)

For personal data processing to be lawful under European Union law, the controller must establish that at least one of the six alternative legal grounds listed under Article 6(1) applies:

• a) Consent (Art. 6.1.a & Art. 7): Freely given, specific, informed and unambiguous agreement by the data subject. Consent may be withdrawn at any time as easily as it was given.
• b) Performance of a contract (Art. 6.1.b): Processing is strictly necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract.
• c) Legal obligation (Art. 6.1.c): Processing is necessary for compliance with a legal obligation to which the controller is subject under EU or Member State law (e.g., tax, social security, invoicing).
• d) Vital interests (Art. 6.1.d): Processing is necessary in order to protect the vital interests of the data subject or of another natural person (medical emergencies, life-threatening scenarios).
• e) Public task / Official authority (Art. 6.1.e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• f) Legitimate interests (Art. 6.1.f): Necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where overridden by the fundamental rights and freedoms of the data subject (inapplicable to public authorities performing their statutory tasks).

2. Accountability & The Strict Necessity Test

The legal basis must be identified and documented prior to starting the processing. Switching legal bases retrospectively (e.g., attempting to invoke legitimate interest after consent has been withdrawn) is prohibited under EDPB doctrine.

Regarding legitimate interests (Art. 6.1.f), the Court of Justice of the EU ruled in Case C-621/22 (KNLTB) that purely commercial interests are not automatically excluded, but strict necessity and a genuine balancing test (LIA) are legally indispensable.

In practice, processing highly revealing information such as location data requires an autonomous, explicit, and demonstrable legal basis: an organization cannot rely on ambiguous or scattered grounds when individuals cannot reasonably foresee the actual scope of processing (Irish DPC final decision of 21 September 2026, Google Ireland).

Smart glasses — EDPB statement (13 October 2026)

An Article 6 basis must be assessed before and during processing. Consent obtained after recording does not retrospectively legitimise capture; legitimate interests require contextual balancing, especially for uninformed bystanders and AI training (§§ 27–30).

• Assess safeguards in light of the uses and individuals concerned.

Adopted statement, preliminary guidance: no new standalone obligations.

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework