Lawful basis for processing: the seven bases and which to use

The rule: Article 6(1) and its seven lawful bases

Article 6(1) of the UK GDPR says “Processing shall be lawful only if and to the extent that at least one of the following applies”, and then lists seven lawful bases, lettered (a) to (f) with a point (ea) between public task and legitimate interests. Every use of personal data by a school, a nursery, a charity or a care provider – keeping a register, paying staff, writing to supporters, sharing a concern – needs at least one of them, chosen for that purpose.

The seventh, recognised legitimate interest, is point (ea). Section 70 of the Data (Use and Access) Act 2025 inserted it, and regulation 2 of S.I. 2026/82 brought section 70, and Schedule 4, which adds the list of recognised legitimate interests to the UK GDPR as Annex 1, into force on 5 February 2026. The ICO's A guide to lawful basis, updated on 2 April 2026, now says: “There are seven lawful bases available for you to use. No single basis is ’better’ or more important than the others. The most appropriate basis depends on your purpose and relationship with the person.” A page that lists six lawful bases describes the law before February 2026.

Six of the seven bases begin “processing is necessary”; only consent does not. The ICO explains what necessary means: “This doesn’t mean that using the personal information has to be absolutely essential. However, it must be more than just useful and more than standard practice.” Doing something because it is convenient, or because everyone else does it, does not make it necessary.

The choice comes first. The ICO says: “You must determine your lawful basis before you start using the personal information and you must document it.” That rests on two principles in Article 5 of the UK GDPR: personal data must be “processed lawfully, fairly and in a transparent manner”, and the controller “shall be responsible for, and be able to demonstrate compliance with, paragraph 1”, the principle known as accountability.

The seven lawful bases, with an example from each sector

Each basis below is quoted from Article 6(1), followed by a use that typically fits it in a school, a nursery, a charity or a care setting. The examples are typical, not automatic: the same activity can need a different basis in a different organisation, and one activity can have more than one purpose.

1. Consent, point (a): “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. A nursery putting a child's photograph on its public website, where parents can say no and nothing else changes. Our guide to school photo consent works through a genuine consent.
2. Contract, point (b): processing “necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”. A nursery invoicing parents for fees under its contract with them; a charity paying a member of staff under their contract of employment.
3. Legal obligation, point (c): processing “necessary for compliance with a legal obligation to which the controller is subject”. A care provider in England keeping each resident's care record, because regulation 17(2)(c) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires it to “maintain securely an accurate, complete and contemporaneous record in respect of each service user”. A nursery in England recording each child's full name, date of birth, parents and emergency contacts, because paragraph 3.99 of the EYFS statutory framework for group and school-based providers says “Providers must record the following information for each child in their care”; the framework's safeguarding and welfare requirements “are given legal force by Regulations made under section 39(1)(b) of the Childcare Act 2006”.
4. Vital interests, point (d): processing “necessary in order to protect the vital interests of the data subject or of another natural person”. Telling a paramedic about a resident's medical history when she has collapsed and cannot answer for herself. The ICO's guidance on the safeguarding condition says “If someone is in immediate danger, vital interests may be the appropriate lawful basis.”
5. Public task, point (e): processing “necessary for the performance of a task of the controller carried out in the public interest or a task carried out in the exercise of official authority vested in the controller”. A maintained school or an academy teaching its pupils and carrying out its other statutory functions. Section 8 of the Data Protection Act 2018 says point (e) includes processing necessary for “the exercise of a function conferred on a person by an enactment or rule of law”.
6. Recognised legitimate interest, point (ea): processing “necessary for the purposes of a recognised legitimate interest”, meaning one of the conditions in Annex 1. A charity's youth club passing a child's details to the local authority's child protection team: in the ICO's own example, a charity “relies on recognised legitimate interest and the safeguarding condition to share this information”.
7. Legitimate interests, point (f): processing “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”. A charity writing to past donors by post about a new appeal.

Most organisations use several. The ICO's example is a university, which “might rely on: public task for using personal information for teaching and research purposes; and a mixture of legitimate interests and consent for alumni relations and fundraising purposes.” A school, a nursery or a care home follows the same pattern: the basis is chosen purpose by purpose, not once for the whole organisation.

Public authority or not: the question that decides your options

Article 6(1) ends: “Points (ea) and (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” So the first question for any organisation is whether it is a public authority, because a public authority cannot use recognised legitimate interest or legitimate interests for its public work. The ICO puts the other side of it: “If you’re a public authority, much of what you do is likely to be covered by the public task basis.”

Section 7 of the Data Protection Act 2018 decides who is one. For the UK GDPR, the public authorities are public authorities as defined by the Freedom of Information Act 2000, Scottish public authorities as defined by the Freedom of Information (Scotland) Act 2002, the Advanced Research and Invention Agency and bodies named in regulations, and “only the following”, with parish and community councils excepted by section 7(3). A body on that list is a public authority only “when performing a task carried out in the public interest or in the exercise of official authority vested in it”.

For schools, Schedule 1 to the Freedom of Information Act 2000 names the governing body of a maintained school or a maintained nursery school in England and Wales (paragraph 52), the proprietor of an Academy “in respect of information held for the purposes of the proprietor's functions under Academy arrangements” (paragraph 52A), and in Northern Ireland the managers of controlled, voluntary and grant-maintained integrated schools and of pupil referral units (paragraph 54). A council school in Scotland is part of its council, which is a Scottish public authority. For all of them, teaching, safeguarding and the other statutory functions run on public task or legal obligation. The Department for Education's DUAA compliance checklist for schools says: “Public authorities cannot rely on recognised legitimate interests to carry out their statutory functions. Public task will usually remain the most appropriate lawful basis where schools are carrying out their statutory functions.”

The bar is narrower than it looks, because it applies only “in the performance of their tasks”. The ICO's A guide to lawful basis says “If you’re a public authority, there are some limitations on your ability to use consent, legitimate interests and recognised legitimate interest as a lawful basis. But you may still be able to consider these three lawful bases in some cases”, and the DfE tells schools to “continue to complete legitimate interests assessments where standard legitimate interests are used”. A school or trust's alumni or fundraising programme, like the ICO's university, is the kind of activity that may sit outside its public tasks. Saying a school can never use legitimate interests overstates the law.

Independent schools, private and voluntary nurseries, childminders, and charities and care providers that the Freedom of Information Act does not name are not public authorities, so the bar does not touch them. All seven bases are open to them – recognised legitimate interest only for a purpose listed in Annex 1, such as safeguarding, and legitimate interests only where the balancing test comes out in their favour.

Consent, legitimate interests and recognised legitimate interest

Consent is the basis organisations reach for first, and for core work it is usually the wrong one. Article 4(11) of the UK GDPR defines it as “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement”, and Article 7(3) gives a right to withdraw it at any time: “It shall be as easy to withdraw as to give consent.” The UK GDPR's recitals explain, in Recital 43, that consent “should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority”. A parent asked to agree to attendance records, a member of staff asked to agree to payroll, or a resident asked to agree to care notes cannot realistically refuse, and the records are kept whatever they say.

If the organisation would carry on when someone says no or withdraws, consent was never the right basis. The mistake cannot be put right afterwards by switching: the ICO says “you should not swap to a different lawful basis at a later date without good reason. In particular, you can’t usually swap from consent to a different basis.” Keep consent for what is genuinely optional, such as photographs on a public website or a story in the annual report.

Legitimate interests, point (f), is the flexible basis for organisations that are not public authorities, and for a public authority's work outside its public tasks. It carries its own limit: the interest must not be overridden by the person's interests or rights, “in particular where the data subject is a child”. The ICO's page How do we apply legitimate interests in practice? says “To demonstrate that legitimate interests applies, you must do the three-part test”: “(1) The purpose test (identify the legitimate interest)”, “(2) The necessity test (consider if your use of the personal information is necessary)” and “(3) The balancing test (consider the person’s interests)”. The written record of that test is what the ICO calls a legitimate interests assessment, and it is guidance rather than a legal duty: “The UK GDPR doesn’t require you to do an LIA. But you should do one anyway.” Our guide to the legitimate interests assessment takes the three parts and the record in turn.

Recognised legitimate interest, point (ea), has no balancing test: unlike point (f), its wording says nothing about the person's interests overriding the organisation's. Instead it is limited to a closed list of conditions in Annex 1:

• disclosing personal data in response to a request from another body that states it needs the data for its own public task under Article 6(1)(e) (paragraph 1);
• national security, public security and defence (paragraph 2);
• responding to an emergency, where “emergency” has “the same meaning as in Part 2 of the Civil Contingencies Act 2004”, which is narrower than the everyday word (paragraphs 3 and 4);
• crime: detecting, investigating or preventing crime, or apprehending or prosecuting offenders (paragraph 5);
• “safeguarding a vulnerable individual”, where a vulnerable individual is someone “aged under 18” or “aged 18 or over and at risk” (paragraphs 6 to 8).

The processing must still be necessary for one of those purposes, and an organisation cannot add its own: the DfE's checklist puts it as “Schools cannot create their own recognised legitimate interests, the activities in scope are defined.” An adult is “at risk” only if the controller “has reasonable cause to suspect” that the person has needs for care and support, is experiencing or at risk of neglect or harm, and as a result cannot protect themselves (paragraph 8), so a care provider or charity relying on the condition for an adult should record why it was met.

Recognised legitimate interest is not the answer to every safeguarding share. The ICO's safeguarding condition guidance says “The legal obligation lawful basis is likely to be more suitable if you need to handle personal information for safeguarding to comply with a law (either a statute or in common law).” It adds: “If safeguarding is part of your public tasks or functions, your lawful basis is likely to be public task.” And then: “For everyone else, recognised legitimate interest is likely to be appropriate when you’re handling personal information for safeguarding purposes, subject to meeting the criteria of this condition.” In practice that usually points a maintained school or academy to public task, and a private nursery, a charity or an independent care provider to recognised legitimate interest, unless a specific law requires the share.

Special category data, the record and the privacy notice

A lawful basis is not enough on its own for special category data such as health information. Since 20 August 2025, Article 9(2) of the UK GDPR has opened “Paragraph 1 shall not apply if the processing is based on Article 6(1) and one of the following applies”, and the ICO says “If you want to use special category data, you must identify both a lawful basis and an additional condition for using this type of information.” An Article 9 condition is never an alternative to an Article 6 basis: both are needed.

A care provider in England recording a resident's health needs usually pairs legal obligation under regulation 17 with Article 9(2)(h), processing necessary for “the provision of health or social care or treatment”. In the UK that condition does not stand alone. Section 10(2) of the Data Protection Act 2018 says it is met “only if it meets a condition in Part 1 of Schedule 1”, which for care is paragraph 2, processing “necessary for health or social care purposes”. Section 11(1) then supplies the obligation of secrecy, which is met where the processing is carried out “by or under the responsibility of a health professional or a social work professional” or “by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law”.

Safeguarding records often hold special category data too, such as a child's health or an adult's care needs. Where substantial public interest under Article 9(2)(g) is the condition, section 10(3) ties it to Part 2 of Schedule 1, and paragraph 18 covers processing necessary for “protecting an individual from neglect or physical, mental or emotional harm” or protecting their well-being, where the individual is under 18 or an adult at risk, the processing is carried out without consent for one of the reasons it lists, and it is “necessary for reasons of substantial public interest”. Under paragraph 5, “Except as otherwise provided”, a Part 2 condition is met only if “the controller has an appropriate policy document in place”.

Write the decision down where people will look for it. The ICO says “you must keep a record of which basis you’re relying on for each purpose and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies.” Most organisations keep it as a column in their record of processing activities, beside the Article 9 condition where one is needed, and the DfE's checklist tells schools to update their records of processing activities, data sharing agreements and related documentation if lawful bases change.

Then tell people. Article 13(1) requires the information given when personal data is collected to include “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing” and, where the basis is legitimate interests, “the legitimate interests pursued by the controller or by a third party”. A privacy notice that says only “we process your data in line with the law” does neither.

The basis also decides which rights apply. Article 21(1) gives a right to object “on grounds relating to his or her particular situation, at any time” to processing based on point (e), (ea) or (f) of Article 6(1) – public task, recognised legitimate interest and legitimate interests – so an organisation relying on one of those needs a way to receive and weigh an objection. Processing based on consent has its own exit: withdrawal.

Where ComplyChat fits, and where it does not

ComplyChat does not choose a lawful basis for you, write your record of processing or your privacy notice, or manage consent. Those decisions belong to the organisation and its data protection officer, and the sources in this guide are where to make them.

What it does touch is one activity that is often missing from the record: the messages staff exchange with each other, and with parents, families and volunteers. Those messages carry personal data like any register or care note, so they need a lawful basis and a line in the record of processing. An organisation can only state and apply a basis to messages it holds. When the conversation runs in a WhatsApp group on staff's own phones, the organisation cannot say where the messages are, how long they are kept or who can see them, and that line in the record stays blank or guesses.

ComplyChat is designed to bring those conversations into channels the organisation runs. A mobile number verified by SMS is an identity, so parents, families and volunteers can be added without an account on the organisation's systems; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the organisation's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat does not capture or archive WhatsApp; it replaces the group chat.

A question for the next leadership or board meeting: does our record of processing have a line for staff messaging, with a lawful basis beside it, and could we say where those messages are?

Questions people ask

Are there still six lawful bases for processing personal information under the GDPR?

Under the UK GDPR there are now seven, not six: since 5 February 2026 Article 6(1) has listed consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. The six that many pages still list are the bases that applied before the Data (Use and Access) Act 2025 added recognised legitimate interest as point (ea), and the ICO now says “There are seven lawful bases available for you to use.”

Do you need to document your decision on which lawful basis applies?

Yes. The ICO says “You must determine your lawful basis before you start using the personal information and you must document it”, keeping “a record of which basis you’re relying on for each purpose and a justification for why you believe it applies”. That follows from the accountability principle in Article 5(2) of the UK GDPR; there is no standard form, and the record of processing activities is the usual home.

What are the lawful bases for processing personal data under Article 9?

Article 9 does not create extra lawful bases: special category data such as health information needs an Article 6 basis and one of the Article 9(2) conditions, and Article 9(2) now says so expressly (“the processing is based on Article 6(1) and”). A care provider recording health information typically pairs legal obligation with the Article 9(2)(h) health or social care condition, which in the UK also needs the matching condition in Part 1 of Schedule 1 to the Data Protection Act 2018 (section 10(2)).

What is an example of a legal basis?

A care provider in England keeping each resident's care record relies on legal obligation, because regulation 17(2)(c) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires it to “maintain securely an accurate, complete and contemporaneous record in respect of each service user”. A maintained school or academy teaching its pupils relies on public task, which section 8 of the Data Protection Act 2018 says includes processing necessary for “the exercise of a function conferred on a person by an enactment or rule of law”.

Can a school use legitimate interests or recognised legitimate interests?

Not for its core work. Maintained schools and maintained nursery schools, academy trusts and, in Northern Ireland, controlled, voluntary and grant-maintained integrated schools are public authorities under the Freedom of Information Act 2000, as are Scottish councils, which run council schools, under the Scottish Act. Article 6(1) says legitimate interests and recognised legitimate interest “shall not apply to processing carried out by public authorities in the performance of their tasks”. Outside its public tasks a school may still consider legitimate interests. Independent schools are not public authorities under either Act, so they can use legitimate interests (with the balancing test) and recognised legitimate interest (only for an Annex 1 purpose such as safeguarding).

What does “not a lawful basis for processing” mean?

It means none of the seven bases in Article 6(1) applies, so the processing is unlawful: the article says processing “shall be lawful only if and to the extent that at least one of the following applies”. Infringing the basic principles for processing, including conditions for consent, in Articles 5, 6, 7 and 9 falls in the higher tier of fines in Article 83(5) of the UK GDPR: up to £17,500,000 or, for an undertaking, 4% of total worldwide annual turnover in the preceding financial year, whichever is higher.

Official guidance and your next step

The law is in Article 6, Annex 1 and Article 9 of the UK GDPR, with sections 7, 8, 10 and 11 of and Schedule 1 to the Data Protection Act 2018. The ICO's A guide to lawful basis (updated 2 April 2026), its safeguarding condition guidance and How do we apply legitimate interests in practice? are the regulator's guidance; the ICO quotations here are from copies saved on 8 and 9 November 2026. For schools in England, the DfE's DUAA compliance checklist for schools (added 14 October 2026) covers the 2025 Act's changes; its older chapter Data processing a school is permitted to do, last updated in February 2023, is out of date: it still says there are six lawful bases.

This guide covers the UK. Regulation 17 applies to care providers registered in England, and the EYFS framework and the DfE's guidance apply in England; providers elsewhere should check their own nation's rules. It is not legal advice. For each sector's wider duties, see GDPR in schools, GDPR for nurseries and childminders and the care home privacy notice.

Then do one thing: open your record of processing activities and read down the lawful-basis column. Mark every line that says consent but would carry on without it, every line that relies on legitimate interests or recognised legitimate interest if you are a public authority, and every line of health or other special category data with no Article 9 condition beside it. Those marks are your next review.