Article 6 GDPR: Legal Bases for Personal Data Processing

The six legal bases defined by Article 6 of the GDPR

Article 6 of the GDPR makes the lawfulness of any personal data processing contingent on the existence of a valid legal basis. Six bases are recognised: the consent of the data subject, the performance of a contract to which they are party, compliance with a legal obligation incumbent on the controller, the protection of the vital interests of the data subject or a third party, the performance of a task carried out in the public interest or in the exercise of official authority, and finally the pursuit of the legitimate interests of the controller or a third party, provided these do not override the rights and freedoms of the data subjects.

Choosing the right legal basis is not a trivial matter: this choice directly determines the rights exercised by individuals (right to object, right to data portability, withdrawal of consent) and the obligations it creates for your organisation. A poorly identified legal basis exposes you to a significant non-compliance risk.

Documenting and managing your legal bases methodically

In practice, each processing activity recorded in your register of processing activities must explicitly state the legal basis selected, accompanied by a justification. This documentation is one of the first elements examined during a CNIL audit. It is therefore essential to regularly review the relevance of the chosen legal bases, particularly when purposes or internal processes evolve.

• Identify all your processing activities and assign an explicit legal basis to each one.
• Verify consistency between the legal basis, privacy notices, and the rights made available to individuals.
• Update your register whenever a processing activity changes or a new one is launched.

Data Comply One supports organisations in this process by centralising the management of the processing register and facilitating the qualification of legal bases for each activity.