Legal justification required under GDPR for processing personal data.
Lawful basis is the legal ground justifying personal data processing under GDPR. The six bases are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Processing without lawful basis is unlawful. Organisations must identify and document appropriate basis before processing begins. Different bases have different implications—consent can be withdrawn; legitimate interests requires balancing tests. Basis cannot be changed retrospectively.
Why It Matters
The DSC Perspective:
Every processing activity needs lawful basis. Document your basis for each processing purpose. Relying on incorrect basis can invalidate all your processing of that data.