No basis, no processing
The GDPR's rule is blunt: every use of personal data needs one of six lawful bases, chosen before you process and recorded. This is a bigger shift than it sounds for a team coming from the PDPA's consent-first world, where "did they agree?" was the main question. Under the GDPR, consent is just one of six doors - and often not the best one, because it can be withdrawn and it is the easiest to get wrong. This session makes the choice concrete.
Match the basis to the purpose 7 min live
You do not pick a basis you like; you pick the one that fits what you are actually doing. Most business processing lands on one of three: contract, legitimate interests, or consent.
LiveThe three you will actually use3 min▶
- Contract (6(1)(b)): processing genuinely necessary to deliver the service the person asked for. You do not need consent to use an address to ship the order they bought.
- Consent (6(1)(a)): for things that are not necessary to the service - marketing, optional analytics. It must be a real opt-in and can be withdrawn.
- Legitimate interests (6(1)(f)): a flexible basis for genuine business needs like fraud prevention or security - but only if you can show a balancing test.
- The other three - legal obligation, vital interests, public task - are narrower and situational.
Live★ Build-along: pick a basis3 min▶
Set the checker to a purpose and read the suggested basis and its catch. Try "deliver a service the person asked for" (contract), "send marketing" (consent), and "fraud prevention" (legitimate interests) - and note how special-category data always adds an Article 9 condition on top.
The two that need care 8 min live
Consent and legitimate interests are the two bases teams reach for most - and the two they most often get wrong. Each has a bar you must clear.
LiveThe consent standard + the LIA3 min▶
- Consent must be freely given, specific, informed, and unambiguous (Art 4(11)) - a clear affirmative action, never a pre-ticked box or silence. You must be able to demonstrate it (Art 7), and it must be as easy to withdraw as to give.
- Legitimate interests is the only basis with a built-in "except where overridden" clause, so it needs a balancing test - documented as a three-part Legitimate Interests Assessment (LIA): the interest, its necessity, and the balance against the person's rights. (LIA is the regulator's method name, not a statutory term.)
- Special-category data (health, biometrics, beliefs) needs an Article 9 condition on top of your Article 6 basis - an Article 6 basis alone is not enough.
Lumina's analytics call. Lumina wanted "consent" for its product analytics, then realised most users ignore the banner - fragile consent. It switched routine, privacy-respecting analytics to legitimate interests with a documented LIA, and kept consent only for genuine marketing. Fewer banners, stronger footing.
Self-studyWhy you cannot swap bases later2 min read▶
A quiet rule that trips teams up: you should choose your lawful basis before you process, and you cannot casually switch it afterwards to dodge an inconvenience. If you told people you rely on consent and they withdraw it, you cannot then say "actually it was legitimate interests all along" to keep processing. The basis you picked and documented is the one you are held to. This is why documentation is not bureaucracy: the record of which basis, for which purpose, and why, is what lets you answer a regulator or a data-subject cleanly - and what stops you quietly relying on consent for something that should have had a firmer basis from the start. Pick deliberately, write it down, and treat a change of basis as a real decision with its own notice to the people affected.
Assign Lumina's bases ★ 10 min · the checker above
Give each of Lumina's real purposes a basis and note the catch.
Account + billing. Processing to run the service the customer signed up for. Which basis? (Contract.) Note that no consent is needed for what the service requires.
Product analytics. Run it through the checker. Consent or legitimate interests? If legitimate interests, sketch the three-part LIA in a line each.
Marketing emails. The checker points to consent. Write what a compliant opt-in looks like (clear, specific, withdrawable) versus a pre-ticked box.
Any health/sensitive data? If Lumina touched special-category data, note that it needs an Article 9 condition on top - and mark it as a get-advice item.
Before session b3 ◐ 40 min total
- List your real processing purposes and assign each a lawful basis using the checker; write one line of justification per purpose.
- For any legitimate-interests purpose, draft the three-part LIA (interest, necessity, balance).
- Find one place you currently rely on consent that would be firmer as contract or legitimate interests, and note the switch.
- Read: GDPR Articles 6 and 7 - the bases and the consent conditions.
Official sources covered
Taught from the GDPR text. This page covers ~80% of the working content on lawful bases.
Three questions before you go 🎯 ◐ 90 seconds
1 · You process a customer's address to ship the product they bought. The best lawful basis is...
Contract (Art 6(1)(b)) fits processing necessary to perform the service. Using consent here is fragile: they could withdraw it and you would still need the address to fulfil the order.
2 · To rely on legitimate interests, you must...
Legitimate interests (6(1)(f)) is the only basis with a built-in balancing clause, so you must run and record the three-part assessment weighing your interest against the person's rights.
3 · To process special-category data (e.g. health), an Article 6 lawful basis is...
Special-category data is prohibited unless an Article 9(2) condition applies, on top of your Article 6 basis. Two locks, not one.