Fiche 22/54 Part 3 — Lawfulness & Key Actors Intermediate Reviewed 2026-08-23

The 6 Legal Bases for Processing (Art. 6.1)

An organisation cannot process personal data without an explicit legal foundation. Article 6(1) sets out an exhaustive list of six lawful grounds: consent, contract, legal obligation, vital interests,

Open in interactive reader

⚖️ Exhaustive Legal Grounds 📋 Art. 6(1) Framework

The 6 Legal Bases for Processing (Art. 6.1)

⚡ In 30 seconds

Under Article 6(1), processing is lawful only if and to the extent that at least one of six grounds applies: (a) Consent, (b) Contract performance, (c) Legal obligation, (d) Vital interests, (e) Public task, or (f) Legitimate interests. The legal ground must be determined prior to collection and communicated clearly to individuals.

Legal Basis	Statutory Scope	Typical Use Case
(a) Consent	Freely given, specific, informed, and unambiguous indication of wishes.	Direct marketing newsletters; non-essential tracking cookies.
(b) Contract	Strictly necessary for contract performance or pre-contractual steps.	E-commerce order fulfillment; billing; user account management.
(c) Legal Obligation	Necessary for compliance with an EU or Member State statutory duty.	Tax records retention; anti-money laundering (AML/KYC) checks.
(d) Vital Interests	Necessary to protect the life of the data subject or another natural person.	Emergency medical care; disaster humanitarian response.
(e) Public Interest	Performance of a task carried out in the public interest or official authority.	Public healthcare management; census operations; social security.
(f) Legitimate Interests	Pursued by controller/third party, provided fundamental rights do not override.	Fraud prevention; corporate network security; B2B direct communications.

⚡ Key Takeaways

There is no legal hierarchy between the six grounds: consent is not superior to contract.
Public authorities cannot rely on legitimate interests (Art. 6.1.f) for tasks performed in the exercise of their public powers.
The chosen ground dictates applicable rights (e.g. no right to erasure if legal obligation applies).

⚠️ Common Pitfall

Collecting employee consent for payroll processing; employment contract performance (b) or legal obligation (c) is the correct ground.

🛠️ In Practice

Audit each database table and map each active data flow to its exact Article 6 legal ground.

⚖️ Official Sources: Art. 6(1) GDPR · Recitals 40–50 · EDPB Guidelines 2/2019 ✓ Legal review: 23 August 2026