Harper James is a modern, full-service UK commercial law firm advising ambitious businesses on the laws of England and Wales, with data protection and DPO support among its practice areas. For any organisation handling personal data, selecting the correct lawful basis under the UK GDPR is a practical governance decision, not a wording exercise.
The UK GDPR recognises six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Consent must be freely given, specific, informed and unambiguous, and people must be able to withdraw it. Contract is relevant where processing is necessary to provide a service or take steps requested by the individual. Legal obligation applies when legislation requires the processing. Vital interests is reserved for situations involving someone’s life or serious threat to health. Public task generally concerns functions carried out in the public interest or under official authority.
Legitimate interests is often used in commercial settings, but it requires a documented three-part assessment. The organisation must identify a genuine interest, show that the processing is necessary, and balance that interest against the individual’s rights and reasonable expectations. Businesses should not treat it as a default basis, especially for direct marketing, monitoring or data uses that people would not expect. Explore further guidance on lawful bases before finalising a processing activity.
Start by describing the processing precisely: whose data is involved, what the organisation will do, why it is doing it, and who will receive the information. Then select the basis that most accurately matches that purpose. Record the reasoning in the organisation’s records of processing activities and align the privacy notice, retention period and security measures with it. A single project can involve several purposes, each requiring its own lawful basis. Consent for marketing, for example, does not automatically cover account administration or fraud prevention.
Extra rules apply to special category data, such as health, biometric or political information. A lawful basis under Article 6 is still required, together with a separate condition under Article 9. Criminal offence data has additional requirements under Article 10. Organisations should also review automated decision-making, children’s data, direct marketing under PECR and international data transfers as connected compliance questions. The most reliable approach is to document the decision before processing begins, review it when the purpose or technology changes, and ensure operational teams follow the stated basis in practice.