Lawful basis
Definition
The legal ground, chosen from a closed list in data protection law, that makes a specific processing of personal data permissible, such as consent, contract, legal obligation or legitimate interest.
Every processing operation needs a lawful basis, identified before processing starts and tied to a specific purpose. GDPR Art. 6 lists six: consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. The LGPD (Art. 7) lists ten, adding bases such as protection of credit, exercise of rights in legal proceedings, health protection and research by research bodies. Special categories need a condition from GDPR Art. 9 or LGPD Art. 11.
No basis is superior to the others. Consent is often the wrong choice when the relationship is unbalanced, as with employees, or when the processing is necessary anyway. Choosing a basis has consequences: it determines which data subject rights apply and what must be told in the privacy notice.
For AI, each stage may need its own analysis. Training a fraud model on transaction history, using customer data to fine-tune a chatbot and running the model in production are different purposes, and the basis for one does not automatically cover the others.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 1: Data protection foundations.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 6
- LGPD Arts. 7 and 11