What is a Lawful Basis?

Every use of personal data needs a legal reason. Not a good intention, not a privacy policy, but a named justification chosen from a fixed list of six. GDPR calls it a lawful basis, and the choice shapes everything downstream: what you can do with the data, which rights people can exercise against you, and what happens when somebody objects. It is one of the first data protection decisions an organisation makes, and one of the most quietly consequential. (This entry is a practical explainer, not legal advice.)

The six bases in ordinary language

• Consent. The person agreed, freely, specifically and knowingly, and can change their mind at any time. Withdrawing must be as easy as agreeing was.
• Contract. You need the data to deliver a contract with that person: their bank details to pay their salary, their address to deliver what they bought.
• Legal obligation. The law requires the processing: tax records, right-to-work checks, statutory reporting.
• Vital interests. Someone’s life or safety is at stake. Rare outside genuine emergencies.
• Public task. An official function or task in the public interest requires it. Mostly the territory of public bodies.
• Legitimate interests. You have a genuine interest, the processing is necessary to pursue it, and it is not overridden by the person’s rights and freedoms. The most flexible basis, and the only one that demands its own recorded test, the legitimate interests assessment.

Why “we have consent” is often the wrong answer

Consent sounds like the safest basis. What could be fairer than asking? In employment contexts it is usually the weakest. Consent only counts if it is freely given, and freedom is precisely what the employment relationship compromises: when your employer asks and your livelihood depends on the relationship, refusal carries a price, and agreement under those conditions is not really agreement. Regulators have said as much for years. The second problem is withdrawal. Consent can be taken back at any moment, so any processing that genuinely rests on it must be able to stop the moment someone says no. Payroll cannot stop. Neither can most security monitoring, scheduling or record-keeping. If the processing would carry on regardless, consent was never doing the work. If the processing would continue after a no, consent was never the real basis. Name the one that is. That is not a counsel of cynicism; it is a test of honesty. The basis that survives the no (contract, legal obligation, or a properly assessed legitimate interest) is the one that should have been claimed from the start, openly, so that people know where they stand.

Choosing the basis is a decision. Treat it like one.

The basis must be chosen before processing begins, told to the people concerned, and is hard to change afterwards. That gives it the shape of a consequential, near-irreversible decision, yet in many organisations it is settled by default, inherited from a template privacy notice nobody re-examined. Treating it as a real decision means naming the purpose first, narrowly enough that a basis can actually fit it, considering the plausible candidates, and recording the outcome: which basis, chosen by whom, on what reasoning, with what alternatives rejected. When a regulator, a client’s procurement team or the person in the data asks years later, the answer should be a record, not archaeology.

One concrete example

Clearly illustrative, with no customer implied. A contact-centre firm of a few hundred people wants to use call recordings for quality coaching. The first instinct is a consent clause in the employment contract. Tested honestly, it fails twice: no new starter feels free to refuse on day one, and coaching would not stop if one agent withdrew. So the firm assesses legitimate interests instead. Purpose: coaching quality and fair evaluation, a genuine interest. Necessity: blanket recording is more than the purpose needs, so it samples a subset of calls instead. Balance: agents are told plainly what is recorded and why, nothing is covert, retention is short, and the assessment is written down with a date and an owner. The processing shrinks to what the purpose requires, and the basis will survive a challenge, because the reasoning exists on paper rather than in hindsight.

Lawful basis and decision intelligence

A lawful basis is a decision in the fullest sense: options, evidence, consequences and a long tail. Decision intelligence says consequential decisions should be recorded with their reasoning, and this one repays that treatment more than most, because the moment it is challenged, what matters is the reasoning as it stood at the time. A recorded basis carries its provenance: who chose it, when, against which purpose, over which alternatives. It also makes drift visible. Purposes creep, and a basis chosen for one purpose does not automatically cover the next; a firm that can see when today’s processing has wandered from the recorded decision can fix it before someone else finds it. How the basis fits into the wider obligations of a people business is covered in GDPR for BPOs.