GDPR foundations
The seven GDPR principles and the six lawful bases.
Everything in the GDPR rests on Article 5's seven principles, and every processing activity needs one lawful basis from Article 6, chosen before processing starts. Consent is only one of the six, and often not the right one.
Back to GDPR services01 · Seven principles
The seven principles of Article 5
The seventh, accountability, means proving the other six.
- 5(1)(a)Lawfulness, fairness and transparencyA lawful basis, fair treatment, and people told how their data is used.
- 5(1)(b)Purpose limitationCollected for specified, explicit purposes; no incompatible reuse.
- 5(1)(c)Data minimisationOnly what's necessary for the purpose.
- 5(1)(d)AccuracyKept accurate and corrected without delay.
- 5(1)(e)Storage limitationKept identifiable no longer than needed.
- 5(1)(f)Integrity and confidentialityAppropriate security against loss, damage and misuse.
- 5(2)AccountabilityAble to demonstrate compliance: records, policies, DPIAs, evidence.
02 · Six lawful bases
The six lawful bases of Article 6
Pick one per purpose, up front. You can't swap later to rescue processing.
| Basis | When it fits | Watch for |
|---|---|---|
| Consent | Optional activities such as marketing or non-essential cookies | Freely given, specific, informed, unambiguous, and as easy to withdraw |
| Contract | Delivering the service someone signed up for | Must be objectively necessary, not just mentioned in terms |
| Legal obligation | Tax records, employment law, anti-money-laundering checks | Cite the specific law |
| Vital interests | Genuine life-or-death emergencies | Rarely used; not a fallback |
| Public task | Public bodies, or tasks with a clear basis in law | Needs that legal basis |
| Legitimate interests | Fraud prevention, security, some customer analytics | Document a legitimate interests assessment (LIA) balancing test |
Special category data needs more
Health, biometric, genetic data, racial or ethnic origin, religious or political views, trade-union membership, sex life or orientation: processing is prohibited unless an Article 9 condition also applies, such as explicit consent.
03 · Choosing a basis
Choosing a basis for a real activity
Start from what the activity is for, not from the form you already have.
Illustrative: an online course platform runs five activities. Delivering paid lessons fits contract. Keeping invoices for the tax office fits legal obligation. Blocking fake sign-ups fits legitimate interests. A weekly promotional email to past learners is a consent or soft opt-in question under the national e-privacy rules. Storing a learner's health note for an exam adjustment needs a basis plus an Article 9 condition.
| Question to ask | If yes | If no |
|---|---|---|
| Would the service fail without this processing? | Contract is likely | Look at the other bases |
| Does a named law require it? | Legal obligation, and record which law | Look at the other bases |
| Can the person say no with no penalty? | Consent can work | Consent will not be freely given |
| Would a reasonable person expect it, with low impact? | Legitimate interests, with a written LIA | Reconsider the activity itself |
The three parts of a legitimate interests assessment
Name the interest you pursue, show the processing is necessary for it, then balance it against the person's rights, with extra weight where the data is sensitive or the person is a child. Keep the written result.
04 · Common mistakes
Where principle work usually fails
Most findings are habits, not bad intent.
- Consent bundled into terms. A tick box that also covers the contract is not a free choice.
- Keeping data just in case. No retention period means storage limitation has no answer.
- Collecting every field. Forms that ask for a birth date or address nobody uses fail minimisation.
- Reusing data for a new aim. Training a model on support chats needs a compatibility check first.
- No record of the choice. A basis nobody wrote down cannot be shown under accountability.
05 · What a regulator asks
What a supervisory authority asks, and the DPDP view
The same five questions, and how India's Act frames them.
- Which basis, for which purpose?. Expect a register, one row per activity.
- Where is the proof?. Consent logs, LIA files, or the law relied on.
- How long do you keep it?. A retention schedule that matches the purpose.
- How do people find out?. The privacy notice, shown at the right moment.
- Who reviews changes?. A named owner when purposes change.
India's Digital Personal Data Protection Act, 2023 leans harder on consent and notice, with a short list of legitimate uses in place of a general interests test. Teams that serve both markets keep one register and tag each row with its GDPR basis and its DPDP ground.
- Valid consent and noticesWhat a notice says and what makes consent count.
- Processing without consentThe legitimate uses and the exemptions, and their limits.
Sources: Regulation (EU) 2016/679, Articles 5 to 9; EDPB Guidelines 05/2020 on consent; Digital Personal Data Protection Act, 2023. This page is general information, not legal advice; counsel should confirm how it applies to your contracts.
More about principles and lawful basis
Do we need consent for all processing?
No. Consent is one of six bases.
Most core processing runs on contract, legal obligation or legitimate interests. Use consent where people have a real choice, and where withdrawing it won't break the service.
Can we change the lawful basis later?
Not to rescue processing that lacked one.
Choose and record the basis before you start. Switching basis after the fact, for example when consent is withdrawn, is a classic finding.
Can a child consent to an online service?
Only at or above a national age line.
Article 8 sets the age at 16 unless a member state lowers it, to no less than 13. Below that line, the holder of parental responsibility must authorize it.
Is legitimate interests the safe fallback?
No. It needs a written balancing test.
It is a flexible basis, not a free one. People can object to it, and a missing or thin assessment is easy for a regulator to challenge.
Do the principles apply to staff data?
Yes, in full.
Employee records follow the same seven principles. Consent is rarely suitable there because of the power imbalance, so contract, law or legitimate interests usually carry it.
Get your lawful bases on record.
A GDPR gap assessment maps each processing activity to a lawful basis and the evidence behind it.