The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful.
The legal bases in Art. 6 GDPR
- consent of the data subject
- performance of a contract or pre-contractual measures
- compliance with a legal obligation
- protection of vital interests
- performance of a task carried out in the public interest
- legitimate interests of the controller or a third party
For special categories of personal data, an exception under Art. 9(2) GDPR must also apply.
Practice
The legal basis must be determined before processing begins and stated in the privacy information. Switching later, for example from consent to legitimate interest after consent has been withdrawn, is problematic.
Legal provisions
- Art. 6(1) GDPR
- Exhaustive list of legal bases.
- Art. 9(2) GDPR
- Exceptions for special categories.
- Art. 13(1)(c) GDPR
- Obligation to state the legal basis.
Related terms.
Prohibition subject to permission (Verbot mit Erlaubnisvorbehalt) The prohibition subject to permission describes the principle that processing personal data is prohibited unless it is permitted by a legal basis. Art. 6(1) GDPR 
Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR
All terms from A to Z Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR 