Lawful Basis
Follow topic LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.This topic is essential as Article 6 GDPR provides the specific legal bases that determine whether processing is lawful, which is the core requirement of the 'Lawfulness of processing' content.
Overview
13 sources · Jul 23, 2026Legal Framework
Article 6(1) GDPR establishes six independent lawful bases for processing personal data: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Processing is lawful only if at least one basis applies before processing begins. Recital 47 elaborates on legitimate interests under Article 6(1)(f), permitting processing when the controller's interests do not override the data subject's fundamental rights and reasonable expectations, particularly where a relevant relationship exists. Recital 46 clarifies that vital interests under Article 6(1)(d) generally apply only where processing cannot be based on another legal basis, typically involving life-threatening situations or humanitarian purposes. The controller bears the burden of documenting the applicable basis under the Article 5(2) accountability principle.
Key Developments
The CJEU's ruling in Data Protection Commissioner v. Facebook Ireland (Schrems) underscores that supervisory authorities possess broad powers to scrutinize whether a lawful basis adequately protects data subjects, especially in cross-border contexts. While Schrems primarily addresses transfer mechanisms, it reinforces that national DPAs can independently assess the lawfulness of underlying processing operations. In Fashion ID v. Verbraucherzentrale NRW, the CJEU established that controllers must provide transparent information about the lawful basis relied upon, but only for processing operations where they actually determine purposes and means. This limits joint controllers' information duties to their respective roles. The EDPB's Guidelines 06/2020 on the interplay between PSD2 and the GDPR clarifies how sectoral laws may constrain the availability of certain bases, particularly in financial services. Recent enforcement actions, including the ICO's penalty against Allay Claims Ltd, demonstrate that failure to establish a valid lawful basis—particularly defective consent—triggers strict accountability and financial penalties.
Practical Guidance
- Map processing activities to specific bases: Document which Article 6(1) basis applies to each processing operation before commencement, ensuring the basis is appropriate for the context and data subject relationship.
- Conduct legitimate interest assessments (LIAs): For Article 6(1)(f), perform and document a three-part test identifying the legitimate interest, necessity, and balancing against data subject rights and reasonable expectations per Recital 47.
- Verify consent mechanisms: Ensure consent under Article 6(1)(a) is freely given, specific, informed, and unambiguous, with clear opt-out mechanisms, as defective consent invalidates the basis entirely.
- Limit vital interests to exceptional cases: Reserve Article 6(1)(d) for genuine life-or-death scenarios where no other basis is viable, consistent with Recital 46.
- Align transparency obligations: Provide data subjects with information on the lawful basis relied upon at the time of collection, tailored to the controller's actual role in determining processing purposes, as clarified in Fashion ID.
why this is here
subject to the exceptions permitted under Article 13 of that directive, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7
The excerpt directly addresses the requirement of a lawful basis under Article 7 of Directive 95/46, the predecessor to GDPR Article 6.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
processing of those personal data is necessary for compliance with a legal obligation to which the employer is subject
The ruling interprets the necessity ground under Directive 95/46, which is the predecessor to Article 6(1)(c) GDPR, and is central to lawful basis analysis.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
the main legal basis for the processing of personal data for the provision of payment services is Article 6(1)(b) of the GDPR
The document extensively discusses which legal basis applies (Article 6(1)(b), (c), (f), consent) for PSD2 processing.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
Article 7(f) of Directive 95/46 does not, in itself, set out an obligation, but expresses the possibility of processing data such as the communication to a third party of data necessary for the purposes of the legitimate interests pursued by that third party.
The document interprets a lawful basis provision (predecessor to Article 6(1)(f) GDPR) and explains when it can be relied upon, making it directly relevant to lawful basis analysis.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
Consent remains one of six lawful bases to process personal data, as listed in Article 6 of the GDPR.
Consent is discussed as a lawful basis under Article 6, which is central to the topic.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
In principle, every legal ground under Article 6 (1) can provide a legal basis for processing video surveillance data.
The document extensively analyzes lawful bases under Article 6, including legitimate interest, public task, and consent, as they apply to video surveillance.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
Article 7(e) Directive 95/46 must be interpreted as not precluding the processing of personal data by the authorities of a Member State for the purpose of collecting tax and combating tax fraud
The judgment directly interprets the analogous provision to Article 6(1)(e) GDPR, concerning processing necessary for a task in the public interest.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful.
The judgment directly interprets the exhaustive nature of lawful processing grounds, which is the predecessor to Article 6 GDPR.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
Article 315 of Law No 95/2006 cannot constitute, within the meaning of Article 10 of Directive 95/46, prior information
The judgment assesses whether a national legal provision satisfies the Directive's requirements for lawful processing and information duties.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7
The document discusses the lawful basis under Article 7(f) of Directive 95/46, which corresponds to Article 6(1)(f) GDPR, but the central focus is the balancing test rather than lawful bases generally.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
the application of Directive 95/46 makes it possible, where appropriate, to take into account — in accordance, in particular, with Articles 7(f), 11(2), and 13(1)(d) and (g) of that directive — legitimate interests pursued by the controller
The document addresses Article 7(f), the predecessor to Article 6(1)(f) GDPR, specifically on legitimate interest as a lawful basis, but does not cover other grounds for processing.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
the lawfulness of processing pursuant to Article 6;
The document lists lawfulness as one of several compliance aspects for certification criteria, but does not analyze legal bases.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
it is not established that that transfer was ‘necessary’ for the purposes of complying with that obligation
The case applies the necessity requirement similar to Article 6 GDPR lawful bases, particularly in assessing whether the transfer was proportionate, but the law at issue is Article 10 of Regulation 45/2001.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
This outlines a potential lawful basis for processing, namely the performance of a task in the public interest, under the relevant directive provisions.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
persons applying for passports cannot be deemed to have consented to that processing
The case discusses whether consent can serve as a lawful basis, and implicitly addresses the lawfulness of processing when no valid consent exists, which is relevant to Article 6 analysis.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
both necessary for and appropriate to the aim of keeping salaries within reasonable limits
The CJEU assesses whether the interference is necessary and proportionate, which is a core element of lawfulness under Article 6 GDPR, although it does not cite a specific legal basis.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
without the consent, legally required, of the person responsible for processing that data
The document references consent as a legal requirement for processing, but the central issue is admissibility of evidence, not the lawful basis itself.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
the distribution of responsibilities should cover other controller obligations such as regarding the general data protection principles, legal basis, security measures
Legal basis is mentioned only as one of the obligations to be allocated among joint controllers.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
publishing various entries on your blog in which data is collected of the claimed (image, name and surnames) without their consent, or any other legitimizing cause of data processing personal
The core of the decision is that the processing lacked any legitimate basis under Article 6, leading to the fine.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
tackle the application of key data protection requirements (such as lawfulness and transparency, DPIA, etc.)
Only briefly mentions lawfulness without detailing Article 6 bases.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
both Article 17 and Article 21 GDPR can serve as a legal basis for delisting requests
The document mentions legal bases for delisting but does not analyze Article 6 grounds in detail.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
lawfulness according to Article 6 GDPR
Mentions Article 6 as part of general GDPR compliance required before transfer, but not a deep treatment.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
set out specific data protection rules for categories of controllers and processors
The document does not specifically address Article 6 lawful bases, though codes may relate to processing activities.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
The company is accused of not being compatible with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
The document centers on whether a lawful basis exists for processing, specifically rejecting legitimate interest and requiring consent.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
The Disputes Chamber decides that the controller has no infringement committed to Article 6.1 of the GDPR.
The decision explicitly applies Article 6(1) GDPR to assess whether processing had a lawful basis.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
confirming the company's reliance on legitimate interests as a legal basis for processing credit reference agency information
The ruling explicitly addresses whether a lawful basis exists under Article 6, making it core to this topic.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
The AVG provides room to process personal data, but there must be a legal basis before data can be shared or processed.
Explicitly references the requirement of a legal basis for processing, which is core to Article 6 GDPR, though not the main focus.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
Veilig Thuis's processing of the man's data was lawful under the Social Support Act (Wmo)
Shows lawful basis for processing was assessed under Wmo rather than GDPR Article 6 directly, but is central to the ruling.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
why this is here
That interference had a foreseeable legal basis
The document discusses the legal basis for the interference, but not specifically under GDPR Article 6; it refers to French law and Article 8 ECHR.
assessed by deepseek/deepseek-v4-flash-0731 · 7 Sept 2026
Nothing of this type on this topic.
This is the top of each pile — all 50 Case Law · all 30 Guidance · all 69 News