GDPR requires a documented legal basis so organisations can prove that each processing activity is lawful and proportionate. Without that foundation, consent, contractual necessity, legal obligation, vital interests, public interest, or legitimate interests cannot be assessed properly. The test is not informal judgement. It is a documented decision that can be reviewed by regulators or challenged by individuals.
Why GDPR treats legal basis as a required precondition
GDPR makes legal basis a gating decision, not a box to tick after processing starts. That matters because personal data processing is only lawful when the organisation can point to a specific ground that fits the purpose and the context. The documented basis also creates accountability: it shows regulators, auditors, and data subjects how the decision was made and why the processing is justified.
For a deeper regulatory view, the GDPR principle set in the EU General Data Protection Regulation (GDPR) is the controlling reference, while broader governance expectations are also reflected in NIST Privacy Framework guidance on data governance and privacy risk management.
How the documented basis shapes lawful processing decisions
The documented basis determines which rule set applies. Consent must be freely given and withdrawable; contract performance must be necessary for the agreement; legal obligation must be traceable to a real duty; vital interests, public interest, and legitimate interests each carry different tests and limits. Without a recorded basis, organisations blur those distinctions and risk treating convenience as legality.
This is why the assessment has to happen before collection or reuse, not after the fact. A written basis forces the organisation to link purpose, necessity, and proportionality, and it prevents “we always do this” from replacing a legal analysis. It also helps separate lawful processing from over-collection, because the basis should be tied to the minimum data needed for the stated purpose.
For organisations building a control environment around this decision, the NIST SP 800-53 Rev 5 Security and Privacy Controls catalog is useful for structuring privacy governance, recordkeeping, and accountability controls, while the CIS Controls v8 reinforce the broader discipline of inventory, access control, and data protection.
What changes when the basis is missing or weak
When the basis is missing, stale, or mismatched to the actual use, the organisation loses its main defence against unlawful processing claims. The problem is not only compliance paperwork. A weak basis often signals a deeper issue: the purpose was never defined clearly, the data collection is broader than necessary, or later reuse is drifting beyond the original justification.
That creates practical failure modes. A process that began under one basis may later be reused for marketing, analytics, sharing, or retention decisions that need a different justification. If the change is not documented, the organisation may be relying on an assumption that no longer holds. In GDPR terms, the legal basis is part of the processing lifecycle, not a one-time approval.
Risk and Threat Considerations
Missing or vague legal basis documentation creates regulatory exposure, weakens accountability, and makes it harder to defend the necessity and proportionality of processing. It also increases the chance that the same dataset will be reused for a new purpose without the correct lawful ground being reassessed.
Failure mechanism: The organisation cannot demonstrate which lawful ground applies, so purpose creep, unlawful reuse, and invalid consent or necessity decisions go uncorrected until challenge or investigation.
Impact: The result can be enforcement action, processing restrictions, corrective orders, remediation cost, and loss of trust when individuals or regulators test the organisation’s decision record.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Article 6 — Lawfulness of processing | This question is about the lawful basis required before processing personal data. |
| Article 5(2) — Accountability | Documented legal basis is part of proving compliance and accountability for processing choices. | |
| Article 30 — Records of processing activities | Processing records operationalise the documented basis and make it reviewable. | |
| Recommendation — Document and review the Article 6 basis before each processing activity starts. Retain evidence that each processing decision was lawful, necessary, and proportionate. Maintain records that link each processing purpose to its lawful basis and retention rules. | ||
| NIST SP 800-53 Rev 5 | PM-5 — System Inventory | A lawful-basis record depends on knowing what processing activities exist and how data flows. |
| AU-3 — Content of Audit Records | Documented basis decisions need traceable records for review and challenge. | |
| Recommendation — Keep an accurate inventory of processing activities and data uses. Record who approved the basis, when it changed, and why it was accepted. | ||
Practitioner Guidance
What to verify: Every processing activity should have a current, purpose-specific legal basis record that states the ground, the rationale, the data categories involved, and any retention or sharing limits tied to that ground.
Decision rule: If the documented basis does not match the actual purpose, treat the processing as non-compliant until the purpose is revalidated and the record is updated. Do not rely on a generic privacy notice or a historic approval to cover a changed use case.
Practitioner takeaway: The important judgement is whether the organisation can prove, for each processing activity, that the lawful ground was chosen deliberately and still matches what the business is actually doing.
Related resources from NHI Mgmt Group
- Why do organisations need a clear legal basis before processing personal information?
- How should organisations document legal basis and retention periods in a GDPR data map?
- Why does GDPR create higher operational risk for organisations that process EU personal data?
- What should organisations do before moving personal data across borders?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
