Article 6 GDPR: The Six Legal Bases for Processing Personal Data

What does Article 6 GDPR regulate?

Article 6(1) GDPR allows the processing of personal data only if at least one of six legal bases applies: consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent is just one option among several – and in many cases not the most suitable one.

Before any processing, check which legal basis applies under Article 6 of the General Data Protection Regulation (GDPR) and determine it before processing begins. Tell data subjects about it when you collect their data (Art. 13(1)(c) GDPR) and document it in your record of processing activities. For an overview, see our guide to data protection basics.

For special categories of personal data, Article 9 of the GDPR also applies, for example to health data, religious beliefs and biometric data for uniquely identifying a person (such as in fingerprint time tracking). More companies process such data than they realise – for example sick notes or religious affiliation for church tax in the HR department. It is then worth involving heyData’s data protection experts.

Which six legal bases does Article 6(1) GDPR list?

Article 6(1) GDPR lists six legal bases of equal rank. The table summarises them:

In what order should you check the legal bases?

The GDPR does not prescribe an order. In practice, however, it has proven useful to check the more specific legal bases first and consent last, because it can be withdrawn at any time. This order is a practical recommendation, not a requirement of the GDPR:

1. Protection of vital interests (Art. 6(1)(d))
2. Performance of a task in the public interest (Art. 6(1)(e))
3. Legal obligation (Art. 6(1)(c))
4. Contractual relationship with the data subject (Art. 6(1)(b))
5. Legitimate interests (Art. 6(1)(f))
6. Consent (Art. 6(1)(a))

The first two points rarely apply in everyday business, but should be considered for completeness. Important: the legal basis must be determined before processing begins.

Do vital interests and public tasks matter for companies?

Mostly not. Vital interests (Art. 6(1)(d) GDPR) cover situations in which the life or health of the data subject or another person is acutely at risk, for example in a medical emergency. The public task (point (e)) is aimed at controllers entrusted with a task in the public interest or in the exercise of official authority, such as the police or public authorities; in individual cases, it can also concern private companies that have been entrusted with such a task.

When does a legal obligation justify processing (point c)?

When processing is necessary to comply with a legal obligation (Art. 6(1)(c) GDPR). The obligation must arise from Union law or Member State law (Art. 6(3) GDPR). Examples:

• As an employer, you are required to register new employees with their health insurance provider. The same applies to the information required for tax and social security contributions.
• Employers must comply with legal requirements on working hours and record working time. This requires processing employees’ working hours.
• Banks, insurers and other entities subject to anti-money laundering law must verify and document the identity of their customers to prevent money laundering.
• Employers must pay wages and document the payment; minimum wage legislation must also be observed.

When does a contract justify processing (point b)?

When processing is necessary to perform a contract or to take pre-contractual steps (Art. 6(1)(b) GDPR) – including verbal agreements, such as scheduling an appointment. The data subject must be a party to the contract, and pre-contractual steps must be taken at their request. A merely presumed interest is not enough – advertising can therefore generally not be based on this legal basis. The following processes often fall under the contract, meaning consent is not required:

• In a job application, the data submitted may be processed for the selection process (pre-contractual steps). On the use of AI here: AI in recruiting.
• In an employment relationship, the employer may process the data needed to perform the contract, such as bank details for paying wages.
• When a private individual contacts a company, their contact details may be used to respond. When they order online, contact details and payment information may be used for delivery and billing.

When do legitimate interests justify processing (point f)?

When you or a third party have a legitimate interest, the processing is necessary for it and the interests of the data subject do not override it (Art. 6(1)(f) GDPR). You check this in three steps:

• Legitimate interest: Recital 47 names fraud prevention and direct marketing as examples.
• Necessity: The processing must be necessary to safeguard this interest.
• Balancing: The interests, fundamental rights and freedoms of the data subject must not override, particularly for children. Part of the balancing is whether the person can reasonably expect the processing (Recital 47).

Point (f) does not apply to public authorities in the performance of their tasks. Document your balancing and, for high-risk processing, check whether a data protection impact assessment is needed. If in doubt, you can contact heyData’s experts.

When does consent make sense (point a)?

Consent (Art. 6(1)(a) GDPR) is often unnecessary and not always advisable, because it can be withdrawn at any time (Art. 7(3) GDPR). Because it is listed first in Article 6(1), it is easily seen as unavoidable – yet the article lists further, often more suitable legal bases, such as an existing contractual relationship. More on this: the significance of implied consent. If you rely on consent, keep the following points in mind:

• Consent must be freely given and must never be coerced.
• It must relate to specific purposes. The data subject must be informed of the right to withdraw beforehand, and withdrawing must be as easy as giving consent (Art. 7(3) GDPR).
• You must be able to demonstrate that consent was given (Art. 7(1) GDPR).
• Without valid consent, processing based on it must not begin; after a withdrawal, it must stop. Processing up to then remains lawful (Art. 7(3) GDPR).
• Whether consent is freely given also depends on whether a contract is made conditional on consent that is not necessary for it (Art. 7(4) GDPR).

What applies to employee data?

In its judgment of 8 May 2025 (8 AZR 209/21), the German Federal Labour Court held that Section 26(1) of the Federal Data Protection Act (BDSG) must not be applied, because it lacks the safeguards that Art. 88(2) GDPR requires. Where no more specific provisions apply, the GDPR applies directly. Assess processing in the employment relationship against Art. 6(1) GDPR, such as points (b), (c) or (f). How the judgment affects Section 26(2) to (4) BDSG should be clarified legally in each individual case.

What do Article 6(2) to (4) GDPR regulate?

• Paragraph 2: Member States may lay down more specific provisions for points (c) and (e).
• Paragraph 3: The basis for points (c) and (e) must be laid down by Union law or Member State law. It must pursue an objective of public interest and be proportionate.
• Paragraph 4: If you want to process data for another purpose, and this is based neither on consent nor on a legal provision under Art. 23(1) GDPR, you check whether the new purpose is compatible with the original one. Take into account, among other things, the link between the purposes, the context of collection, the nature of the data (e.g. Art. 9 and 10), the possible consequences for data subjects and safeguards such as encryption or pseudonymisation.

Conclusion

Article 6 of the General Data Protection Regulation (GDPR) sets out when the processing of personal data is lawful. Besides consent, there are five other legal bases of equal rank. As a practical recommendation, it has proven useful to check vital interests, public tasks, legal obligations, contracts and legitimate interests first, and only then consent. Consent is not always necessary, can be withdrawn at any time and must be freely given for a specific purpose. If you determine and document the appropriate legal basis before processing begins, you lay the foundation for lawful data processing.

With heyData’s external data protection officer, you determine the right legal basis for every processing activity, document it in your record of processing activities and are better prepared for questions from supervisory authorities.

Take the first step: Book a free demo now