Every processing activity must be based on one of six lawful bases. You must identify and document your legal basis before processing begins.
The Six Legal Bases
- Consent — The individual has given clear consent
- Contract — Processing is necessary for a contract
- Legal obligation — Required to comply with the law
- Vital interests — To protect someone's life
- Public task — For official functions or public interest
- Legitimate interests — For legitimate business purposes (requires balancing test)