Regulation and data
Legal basis for processing
The legal basis, or lawful basis, is what makes it lawful to process personal data. Art. 6.1 of the GDPR allows six: consent, contract, legal obligation, vital interests, a public-interest task or official authority, and legitimate interest. Without one of them, processing is unlawful however useful it is.
Also known aslawful basis · lawfulness of processing · base jurídica
The six bases, in a centre
Every processing operation needs at least one, and the centre has to say which in the information it gives when collecting the data (art. 13.1.c). For legal obligation and public interest, not just any rule will do: Spain's LOPDGDD requires it to be imposed by a rule with the rank of law (art. 8).
| Basis (art. 6.1) | Example in a residence |
|---|---|
| a) Consent | Publishing a photo of an activity; see consent |
| b) Contract | Assigning the room, charging for the stay, serving the meals contracted |
| c) Legal obligation | Keeping invoices for the period tax rules set |
| d) Vital interests | Giving the emergency services the details of a resident who cannot give them |
| e) Public interest or official authority | What a public university does in exercising the powers a law confers on it |
| f) Legitimate interest | Keeping a family contact for emergencies or recording the common areas; see legitimate interest |
Worth knowing
Asking for consent is not the safe default. If what supports the processing is the contract, presenting it as consent promises something that will not hold: that withdrawing it stops the processing. The guide to the GDPR in student residences explains why. Special categories, such as health data, also need an exception under art. 9.2. And processing data with no basis at all is a very serious infringement (art. 72.1.b of the LOPDGDD).
Sources
Related terms
- ConsentConsent is a voluntary, specific, informed and unambiguous indication of a person's wishes by which they agree, through a statement or a clear affirmative action, to the processing of their data (art. 4.11 of the GDPR). It is one of the six legal bases, and the only one the data subject can withdraw at any time.
- Legitimate interestLegitimate interest is the legal basis in art. 6.1.f of the GDPR: it allows processing when necessary for an interest of the controller or a third party, unless the person's rights and interests override it, especially if they are a child. Public authorities cannot use it when performing their tasks.