A lawful basis is the legal ground that permits processing personal data: consent, contract, legal obligation, vital interests, public task or legitimate interests under GDPR Article 6, plus the extra grounds of Brazil's LGPD Article 7. Every processing activity needs one, chosen before it starts and recorded. This selector compares the bases with your scenario, explains the choice and, when legitimate interests is in play, builds the three-part test (LIA).
How to use
- Describe the processing activity, the applicable law and the main purpose.
- Answer whether a contract, legal obligation, public task or vital interests are involved.
- Say whether the person expects the use, can refuse it, and whether sensitive or children's data is involved.
- For legitimate interests, describe the interest, the necessity, the impact and the safeguards.
- Read the suggested basis, alternatives, ruled out bases and the LIA; export to DOCX, PDF or CSV.
What each field asks for
| Field | What to enter |
|---|---|
| Processing activity | What is done with the data and why, in one sentence. |
| Applicable law | GDPR applies in Europe; LGPD applies to processing in Brazil. Many companies need both. |
| Main purpose | |
| Is the processing necessary to perform a contract with the person (or steps before it)? | |
| Does a law or regulation require the organisation to carry out this processing? | |
| Is it a task of a public authority or the delivery of a public policy? | |
| Does it protect someone's life or physical safety? | |
| Situations provided for only in LGPD (optional) | Tick any that the processing fits. |
| Would the person reasonably expect the data to be used this way? | |
| Can the person refuse without any detriment? | If refusing costs them the service, their job or a benefit, consent is not freely given. |
| Is there an imbalance of power (employer, public authority)? | |
| Does it involve special category (sensitive) data? | Health, biometrics, racial or ethnic origin, religion, political opinions, trade union membership, sex life or genetic data. |
| Does it involve data about children? | |
| Interest pursued (for the legitimate interests test) | The concrete benefit of the processing for the organisation, third parties or the person. |
| Is there a less intrusive way to achieve the same purpose? | |
| Likely impact on people | |
| Safeguards already planned (optional) |
Example
A fictional online shop wants to screen orders to stop fraud with stolen cards, under both GDPR and LGPD. As customers cannot refuse the check, consent is ruled out. The selector suggests legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX) with a strong fit, because the check is expected, has low impact and comes with data minimisation, short retention and a clear privacy notice. The LIA concludes the basis holds with safeguards.
When to use
- Before launching a product, a campaign or a new use of customer data.
- When building or reviewing the record of processing activities.
- When the team defaults to consent out of habit and you need to check it is freely given.
- To document the legitimate interests assessment a supervisory authority or the ANPD may ask for.
Frequently asked questions
What are the six lawful bases under GDPR?
GDPR Article 6(1) lists consent, performance of a contract, legal obligation, vital interests, public task and legitimate interests. You need at least one for every processing activity, and you should choose it before processing starts.
Is consent always the safest basis?
No. Consent is only valid if the person can refuse without detriment, and it can be withdrawn at any time. In employment or when the service depends on the processing, consent is rarely freely given and another basis usually fits better.
What is a legitimate interests assessment (LIA)?
It is the three-part test that supports reliance on legitimate interests: purpose (is the interest legitimate and concrete?), necessity (is there a less intrusive way?) and balancing (do the person's rights override it?). Keep the record, because a regulator may ask for it.
Can I rely on legitimate interests for special category data?
Under GDPR you also need an Article 9(2) condition, such as explicit consent or employment law obligations. Under Brazil's LGPD, legitimate interests is not available for sensitive data at all (Article 11).
How do GDPR and LGPD lawful bases differ?
GDPR has six bases in Article 6. LGPD has ten in Article 7, adding credit protection, health protection, studies by research bodies and the regular exercise of rights. The selector shows both references when you choose both laws.
Which DPCert certification covers this topic?
The DPAI (Data Protection & AI Professional) assesses lawful bases and legitimate interests in its data protection foundations domain, alongside data subject rights, accountability tools and breaches.
Is the result legal advice?
No. It is an educational tool that structures the analysis and the record. The final choice of lawful basis should be validated by your data protection officer and legal counsel against the rules currently in force.