6 lawful bases
Lawful Bases
A lawful basis is a ground in law on which a person's data may be processed for a stated purpose. It is the condition that makes processing permitted at all. It is not a choice the person made about being contacted, and holding one says nothing about how they wish to hear from anyone.
What you can do with a lawful basis
Its lawful bases— 6
- ConsentThe person has freely given a specific, informed and unambiguous agreement to processing for one or more stated purposes. It can be withdrawn, and withdrawing it is meant to be as easy as giving it.
- ContractProcessing is necessary to perform a contract the person is party to, or to take steps they asked for before entering one.
- Legal ObligationProcessing is necessary for the organisation to comply with an obligation the law places on it.
- Vital InterestsProcessing is necessary to protect someone's life or physical safety, whether the person's own or another's.
- Public TaskProcessing is necessary to carry out a task in the public interest, or one exercised under official authority.
- Legitimate InterestsProcessing is necessary for interests the organisation or a third party pursues, unless the person's own rights and freedoms override them. The balancing of the two is what the ground consists of, not a formality after it.
Why it matters
What goes wrong without it, as the commitments that license this kind say it, each standing on its sources.
- Keep audience eligibility, preference and permission basis distinctThese answer three different questions — can this person be reached, how do they want to be reached, and are we permitted to reach them — and collapsing them is how an organisation comes to treat membership of a segment as a consent. Eligibility is an addressing fact, preference is a stated choice, and a permission basis is a condition with a purpose and a jurisdiction. Only the last has anything to say about whether an activation is allowed.
Regulation (EU) 2016/679, Article 6 · Audience Taxonomy · Global Privacy Protocol · Data Privacy Vocabulary · Regulation (EU) 2016/679, Article 7: Conditions for consent · Consent Receipt Specification 1.1 · Transparency and Consent Framework v2.2 · RFC 8058: Signaling One-Click Functionality for List Email Headers