How does public task work?

What public task actually authorises

public task is a legal basis for carrying out processing that is necessary for a task performed in the public interest or under official authority. The key question is not whether the activity is useful, but whether it is tied to a recognised mandate, public function, or statutory power that can justify the processing.

That means the basis works best where the organisation can point to a defined responsibility, such as delivering a public service, regulating an activity, or exercising a formal public power. If the activity starts to look like ordinary commercial processing, the legal basis usually becomes harder to defend.

Where organisations usually go wrong

The most common failure is overextension: using public task as a broad label for anything adjacent to a public mission. That weakens accountability because the organisation no longer has a precise explanation for why the processing is necessary, why the scope is limited, and why the same outcome could not be achieved with less intrusive processing.

Another weakness is poor purpose discipline. Public task requires a clear line from the processing activity to the mandate, and that line should remain visible in records, policies, and internal approvals. If staff cannot explain the legal authority in plain terms, the organisation is usually relying on assumptions rather than a defensible basis.

What “good” looks like in practice

A sound public task assessment starts with the legal mandate, not the data set. Teams should be able to state which public function the activity supports, what data is strictly needed, and why the same processing would be inappropriate if the organisation were acting for private commercial purposes.

It also helps to separate the legal basis from the operational convenience. Public task may be the right basis for one part of a workflow and not for another, so practitioners should review processing at the activity level rather than treating an entire system or programme as covered by a single blanket justification.

Risk and Threat Considerations

Public task creates compliance and trust risk when organisations stretch a public mandate beyond its lawful scope. The exposure is not only regulatory, it also affects transparency, challenge rights, and the credibility of the organisation’s authority to process personal data.

Failure mechanism: The organisation treats a broad mission statement or policy goal as sufficient authority, instead of mapping each processing activity to a specific legal power, duty, or public function.

Impact: The processing can become difficult to defend, harder to audit, and more vulnerable to complaint, supervisory scrutiny, or internal challenge, especially where the activity resembles commercial reuse rather than public service delivery.

Practitioner Guidance

What to verify: Check that each material processing activity has a named mandate, a defined purpose, and a documented necessity test. If the purpose cannot be stated without vague language, the basis is probably too loose.

Decision rule: If the activity is required to perform a public function or exercise official authority, public task may fit; if the activity is mainly about convenience, growth, monetisation, or broad reuse, treat it as a different legal question.

Practitioner takeaway: Public task is strongest when it is narrow, specific, and traceable to authority. The more the explanation depends on organisational mission alone, the more likely it is that the legal basis is being overstated.

Related resources from NHI Mgmt Group

• What should organisations do when employees use public LLMs for work tasks?
• How should public sector organisations govern access when staff work remotely?
• Why do public Wi-Fi attacks still work against informed users?
• What breaks when application security work is handled as a purely technical task instead of an operational change?