Lawful Basis

The ICO's guide confirms the statutory source directly: 'The lawful bases are set out in article 6 of the UK GDPR. You must apply at least one of these whenever you want to handle personal information.' The core six are described in the ICO's own summary wording: '(a) Consent: the person has clearly given consent for you to use their information for a specific purpose', '(b) Contract: the processing is necessary for a contract you have with the person', legal obligation, '(d) Vital interests: the processing is necessary to protect someone's life', '(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions', and legitimate interests. Choosing between them is a matter of fit rather than hierarchy: the ICO states that 'No one basis is always better, safer or more important than the others. There is no hierarchy in the order of the list in the UK GDPR', so organisations must think about their specific purpose and relationship with the individual rather than defaulting to a preferred basis such as consent.

Documentation and timing matter as much as the choice itself. The ICO's guidance requires that 'You must determine your lawful basis before you start using the personal information and you must document it', and it explicitly discourages switching later: 'you should not swap to a different lawful basis at a later date without good reason. In particular, you can't usually swap from consent to a different basis.' Most of the bases (other than consent) turn on whether the processing is genuinely 'necessary' - the ICO explains this 'doesn't mean that using the personal information has to be absolutely essential', but it must be 'more than just useful and more than standard practice' and a 'targeted and proportionate way of achieving a specific purpose'. The lawful basis chosen also has knock-on effects for individual rights: for example, the right to erasure and the right to object apply differently depending on which basis is relied on, and organisations relying on legitimate interests must give people extra detail about that basis in their privacy information under the right to be informed.