GDPR Article 6(1) gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. At least one must apply to each processing purpose. For most software companies the real choice is among contract, consent, legitimate interests and legal obligation.
The six, in plain words
- Consent: the person agreed to one or more specific purposes.
- Contract: processing is needed to perform a contract with the person, or to take steps they asked for before signing.
- Legal obligation: you must process the data to comply with a legal duty.
- Vital interests: needed to protect someone's life, theirs or another person's.
- Public task: needed for a task in the public interest or under official authority.
- Legitimate interests: you or a third party has a legitimate interest, unless the person's rights and freedoms override it, especially for a child.
Legitimate interests is not available to public authorities when they perform their tasks.
A decision flow
Work through the questions in order for each purpose, not for each product.
- Is the processing required by a law that applies to you? Use legal obligation, and record which law.
- Is it necessary to deliver what the customer signed up for? Use contract. Necessary means the service cannot run without it, not that it is useful to you.
- Is it something optional, such as marketing emails or non essential tracking? Consent is often the fit. Make it a real choice.
- Is it a business need that people would reasonably expect and that does little harm, such as fraud prevention or basic security logging? Consider legitimate interests, with a written balancing test.
Vital interests and public task rarely apply to a commercial product team.
Mistakes to avoid
Using consent for everything. Consent must be freely given, specific, informed and unambiguous, and people can withdraw it. If you could not stop processing after a withdrawal, consent is the wrong basis.
Using contract for analytics. Product analytics is rarely necessary to perform the contract, so contract is a weak fit.
Skipping the balancing test. For legitimate interests, write down the interest, why the processing is necessary, and why individuals' rights do not override it.
Forgetting the privacy notice. You must tell people the basis you rely on and, for legitimate interests, what the interest is.
Special category data
Health, biometric and similar data face extra conditions in Article 9, which this post does not cover. A lawful basis under Article 6 is necessary but not enough for that data.
Quick check
Can we change the basis after a complaint?
Do not treat the choice as swappable after the fact. Decide before processing starts, record it, and tell people in your notice.
Do employees need to consent to payroll processing?
Payroll typically sits under contract and legal obligation, not consent. Ask counsel for your jurisdiction.
Fines for breaching the basic principles and conditions under Articles 5, 6, 7 and 9 sit in the higher penalty tier, see GDPR fines explained.
Sources
- GDPR Article 6, lawfulness of processing
- GDPR Article 83, administrative fines
- GDPR Article 7, conditions for consent
- GDPR Article 13, information to be provided
Last reviewed: 19 October 2026.
