Join our Newsletter — 33% off our NHI Course

Legal Basis For Processing

Legal basis for processing is the lawful ground that allows an organisation to collect, use, or share personal data. Under privacy law, each processing activity needs a specific justification such as consent, contract, legal obligation, vital interests, public task, or legitimate interests, with documented purpose, scope, and safeguards.

legal basis is the lawful permission that makes a particular processing activity legitimate, but it is not a blanket approval to do anything with personal data. Each use must be tied to a defined purpose, scope, and legal ground that matches the actual processing.

That distinction matters because organisations often collect data for one reason and later want to reuse it for another. If the second activity does not fit the original basis, the legal analysis has to be revisited rather than assumed to carry over.

In privacy governance, legal basis is therefore a design constraint as much as a legal requirement, because it shapes what data can be collected, which operations are justified, and what safeguards or notices must accompany the activity.

Most privacy regimes recognise a small set of lawful grounds, commonly including consent, contract, legal obligation, vital interests, public task, and legitimate interests. The correct choice depends on the real-world relationship between the organisation, the individual, and the processing purpose.

Some grounds are narrow and purpose-specific. Consent requires a genuine, informed choice; contract applies only where processing is necessary to perform the agreement; legitimate interests requires balancing the organisation’s need against the individual’s rights and expectations.

Choosing the wrong basis can create a governance problem even if the data itself is ordinary. A processing activity that is technically secure but legally unsupported can still be non-compliant, because the issue is authority to process, not only protection of the data once collected.

How Organisations Determine and Document Lawful Ground

Determining the basis starts with the processing purpose, not with a preferred legal category. Teams should be able to explain why the activity needs the data, what the exact use is, and why that use fits one specific lawful ground.

Documentation is essential because legal basis decisions often need to be justified later to auditors, regulators, customers, or internal privacy reviewers. That record should show the purpose, the selected basis, any required notices, and the safeguards that limit use to what was disclosed.

Where a processing activity includes monitoring, sharing, international transfer, or vendor handling, the legal basis analysis usually needs to be aligned with broader privacy controls. NHI Management Group’s GDPR Compliance Guide for Security Teams ties that decision to lawful basis, security of processing, processor terms, and transfer safeguards.

Common Failure Modes and Operational Consequences

The most common failure is treating “we have data already” as equivalent to “we are allowed to use it.” Another is using consent where another basis would be more appropriate, or relying on legitimate interests without a real balancing assessment and clear documentation.

When the chosen basis does not match the activity, the consequences can include unlawful processing, invalid notices, weak vendor controls, and difficulty defending retention or reuse decisions. Those failures often surface only after a complaint, assessment, or incident review.

External guidance on the EU General Data Protection Regulation (GDPR) is useful here because it connects lawful grounds to the core processing principles, security of processing, and accountability obligations that sit around them.

Legal basis does not stand alone. It works alongside purpose limitation, data minimisation, retention limits, transparency, and security measures so that the organisation can explain not only why data is processed, but also why that processing is bounded.

That is why legal basis decisions often affect downstream controls such as access restrictions, processor agreements, retention schedules, and cross-border transfer review. The legal answer and the control answer need to stay aligned.

For organisations that want a broader governance lens, the NIST Privacy Framework helps connect lawful processing decisions to privacy risk management, data governance, and operational control design.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.

Framework Control / Reference Relevance
GDPR Art. 6 — Lawfulness of processing Defines the lawful grounds that make personal-data processing permissible.
Art. 5 — Principles relating to processing of personal data Requires purpose limitation, minimisation, and accountability around the chosen basis.
Art. 30 — Records of processing activities Requires organisations to document processing purposes, categories, and legal context.
Recommendation — Map each processing purpose to a valid lawful basis before collection or reuse. Align each processing activity with a defined purpose and document the justification. Record the lawful basis and scope for each processing activity in your RoPA.
NIST SP 800-53 Rev 5 AR-2 — Privacy Impact and Risk Assessment Supports assessing privacy implications and documenting the justification for processing.
DM-2 — Data Retention and Disposal Supports limiting continued processing to what is justified and needed.
Recommendation — Assess privacy impact before launching or changing a processing activity. Set retention limits that match the stated purpose and legal basis.