Lawful Basis for Processing Personal Data, Explained

Why ‘lawful basis’ matters

Under UK GDPR, you cannot simply use personal data because it is convenient. Every time your business collects, stores, or uses information about a person — a customer, an employee, a supplier contact — you need a lawful basis. That is one of six legal reasons the law recognises for handling personal data.

This sounds technical, but the idea is simple: you should be able to say, in one clear sentence, why you are allowed to use someone’s data. Getting this right is one of the foundations of data protection, and it is far easier to decide up front than to unpick later. If you are new to the wider topic, our GDPR basics for UK small business sets the scene.

The six lawful bases in plain English

UK GDPR gives you six lawful bases. No single one is ‘better’ than the others — the right choice depends on what you are doing and why.

1. Consent. The person has actively and freely agreed to a specific use of their data, and can withdraw that agreement at any time. Think of a newsletter sign-up.
2. Contract. You need the data to fulfil a contract with the person, or to take steps they asked for before entering one. For example, using a delivery address to send an order.
3. Legal obligation. You have to process the data to comply with the law — such as keeping payroll records for HMRC.
4. Vital interests. You need the data to protect someone’s life. This is rare and mostly relevant in emergencies or healthcare.
5. Public task. You are carrying out an official function or a task in the public interest, usually as a public body. Most small businesses will not use this one.
6. Legitimate interests. You have a genuine business reason to use the data, you have checked it does not override the person’s rights and freedoms, and they would reasonably expect it. This is the most flexible basis — and the one that requires the most judgement.

How to pick the right one

The basis should follow the purpose. Ask yourself what you are actually trying to do, then match it to the most natural fit:

• Selling someone a product or service? Contract usually covers the core activity.
• Keeping tax, employment or health-and-safety records? Legal obligation.
• Sending marketing emails to people who have signed up? Consent.
• Using existing customer details for a closely related, expected purpose — like fraud prevention or basic account administration? Legitimate interests often fits.

A few principles help you choose well:

• Pick one basis per purpose, and choose before you start. You should not stack several bases as a fallback, and you should not switch later without good reason.
• Don’t default to consent. Consent feels safe, but it is often the wrong tool. If someone cannot realistically say no — because you need the data to do the job they asked for — then consent is not genuine, and contract or legitimate interests is more honest.
• Write it down. Record your chosen basis for each activity and explain it in your privacy notice.

If someone cannot realistically say no, then consent is not genuine, and contract or legitimate interests is more honest.

Consent versus legitimate interests

These two cause the most confusion, so they are worth separating clearly.

Consent puts the person in control. They opt in, and they can opt out whenever they like. When they withdraw, you must stop. Consent must be freely given, specific, informed and unambiguous — a pre-ticked box or a buried clause does not count. Consent is the right basis for things people should be able to refuse without losing the core service, such as marketing newsletters.

Legitimate interests gives you more flexibility, but with a condition: you must carry out a short balancing exercise, sometimes called a legitimate interests assessment. It has three parts:

1. Purpose — is there a genuine, specific benefit to your business or a third party?
2. Necessity — is using the data a reasonable way to achieve it, with no less intrusive option?
3. Balance — do the person’s rights and reasonable expectations override your interest?

If the interest is genuine, the processing is necessary, and it does not override people’s rights, legitimate interests is a valid and sensible choice. It suits everyday activities people would expect, like preventing fraud or improving your service.

A useful rule of thumb: if you are doing something people would clearly expect and are unlikely to object to, legitimate interests often fits. If you are doing something people should be able to say no to freely, use consent.

A note on special category data

Some data — health, ethnicity, religious beliefs, sexual orientation, and similar — is treated as special category data. Using it needs both a lawful basis from the six above and an extra condition from a separate list. If you handle this kind of information, take extra care and get advice before you start. Businesses in sensitive sectors, such as healthcare, should treat this as a priority.

Keep it simple and write it down

For most small businesses, this is not as daunting as it sounds. Make a short list of the ways you use personal data, put a lawful basis against each one, and reflect it in your privacy notice. That single page of thinking answers the vast majority of questions the ICO — or a curious customer — might ever ask.

If you would like a hand mapping your data and tightening the security around it, DACROS supports small businesses across Leeds and Yorkshire with practical managed IT and cyber-security. Get in touch and we will keep it in plain English.