Glossary · Privacy and data protection
Without a lawful basis, processing fails before any other rule is checked.
The legal ground that allows a particular use of personal data, chosen per purpose: one of six under the GDPR, or consent or a legitimate use under India's DPDP Act.
Back to the glossary01 · In plain words
In plain words
The legal ground that allows a particular use of personal data, chosen per purpose: one of six under the GDPR, or consent or a legitimate use under India's DPDP Act.
Every use of personal data needs a reason the law accepts. The GDPR calls that the lawful basis and lists six in Article 6: consent, contract, legal obligation, vital interests, public task and legitimate interests. India's DPDP Act has a shorter list: consent, or one of the legitimate uses in section 7.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The basis shapes everything after it. Consent can be withdrawn, so a service built on it must cope with withdrawal. Legitimate interests under the GDPR needs a balancing test and gives people a right to object. Public authorities cannot rely on legitimate interests for their tasks. Special category data under Article 9 needs an extra condition on top. The DPDP Act has no general legitimate interests basis. Its legitimate uses are specific: data a person gave voluntarily for a stated purpose without objecting, certain State functions, legal duties, court orders, medical emergencies, epidemics, disasters and employment. If a use fits none of these, you need consent.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The processing record
- Each purpose should show its basis, and for special data, the extra condition.
- A legitimate interests assessment
- A short written balancing test kept for each GDPR use relying on that basis.
- The privacy notice
- The GDPR asks you to tell people the basis for each purpose.
- A marketing review
- Where teams discover a campaign has no basis and needs consent first.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a food-delivery app in two markets
A delivery app runs in India and Portugal. Taking an order and passing the address to a rider is needed to perform the contract, the GDPR lawful basis in Portugal. In India, the customer gave the address voluntarily for delivery, which fits a legitimate use. Fraud scoring in Portugal rests on legitimate interests after a balancing test. In India there is no matching basis, so the app reviews whether it needs consent for that use.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Consent
- Only one basis among several under the GDPR. Leaning on it for everything makes withdrawal a business risk.
- Lawful purpose
- The DPDP Act's test that a purpose is not forbidden by law. A lawful purpose still needs consent or a legitimate use.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Name one basis per purpose, not one per system or product.
- Write a balancing test for every GDPR use relying on legitimate interests.
- For India, check each non-consent use against the section 7 list.
- Show the basis in your notice and plan for consent withdrawal.
- GuideGDPR principles & lawful basisThe seven principles of Article 5 and the six lawful bases.
- GuideProcessing without consentThe legitimate uses and the exemptions, and their limits.
- GuideValid consent and noticesWhat a notice says and what makes consent count.
Sources: Regulation (EU) 2016/679, Articles 5, 6, 7, 9, 13 and 21; Digital Personal Data Protection Act, 2023, sections 4, 6 and 7. Not legal advice.
Questions about Lawful basis
Can we switch basis later if consent is withdrawn?
Generally not, under the GDPR.
Choosing consent and then falling back on another basis when it is withdrawn undermines fairness and transparency. Pick the right lawful basis at the start and tell people what it is.
Does the DPDP Act have legitimate interests?
No general version.
Section 7 lists specific legitimate uses. There is no open balancing test like GDPR Article 6(1)(f). Counsel should confirm how a given use fits the list.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.