Short answer
A controller should start with the specific purpose and processing operation, not with the basis it would prefer. It should then choose the Article 6 GDPR basis whose legal conditions match the facts: valid consent for a genuinely optional choice; contract only for processing objectively indispensable to perform a contract with the person; legal obligation only where EU or Member State law requires the controller to process; public task where law establishes a task in the public interest or official authority; and legitimate interests only after identifying a legitimate interest, proving necessity and balancing it against the person's rights.
These bases are alternatives, not interchangeable labels. Convenience, a clause in terms of service or a general public benefit is not enough. The controller must decide and document the basis before processing, disclose it in the privacy information, and reassess it if the purpose or facts change. Article 6 is also only the first gate: special-category data, criminal-conviction data, electronic communications and national sector rules may impose additional conditions.
Start with a purpose-by-purpose map
Article 6(1) opens with the rule:
“Processing shall be lawful only if and to the extent that at least one of the following applies”. —
“At least one” does not mean that a controller should list every remotely plausible basis. Different operations in one service may have different purposes and bases: an online shop might need an address to deliver an order under contract, retain an invoice to comply with tax law, and separately ask for consent to send an optional newsletter. Each purpose should have its own record covering the data, people, recipients, retention period and basis.
The chosen basis affects the person's rights and the controller's notices. Articles 13 and 14 require the basis to be disclosed; if legitimate interests is used, the interests must also be identified. Consent can be withdrawn. Processing based on legitimate interests or public task is subject to Article 21 objections, though the applicable test differs. Erasure rights also vary by basis and circumstances.
Define the real purpose, apply the exact legal test, check for a less intrusive route and record the evidence. Article 5(2) makes the controller responsible for demonstrating compliance.
When is consent the right basis?
Consent fits genuinely optional processing where the person can make a specific, informed and unambiguous choice without detriment. The controller must be able to demonstrate it. Separate purposes should not be bundled into one acceptance, and silence or pre-ticked boxes do not provide affirmative consent.
Consent is a poor choice when the controller would process regardless of the answer, when refusal prevents a service even though the processing is unnecessary for it, or when an imbalance makes refusal unrealistic. Article 7(4) specifically requires attention to whether a contract or service is conditional on consent to unnecessary processing. Withdrawal must have real operational effect:
“It shall be as easy to withdraw as to give consent.” —
Withdrawal does not retroactively invalidate lawful processing before withdrawal, but the controller needs another lawful reason to continue. It should not present consent as the basis and secretly reserve another basis for the same unchanged purpose if consent is withdrawn.
When is processing necessary for a contract?
Article 6(1)(b) covers processing necessary to perform a contract with the data subject, or requested pre-contract steps. It does not cover every commercial objective, every term the business writes into its contract or every activity that improves the service.
In Meta Platforms v Bundeskartellamt, the Court of Justice set a demanding test:
Processing “must be objectively indispensable for a purpose that is integral to the contractual obligation intended for the data subject.” —
The controller must show that the contract's main subject matter cannot be achieved without the processing. Merely useful processing is insufficient, and a workable, less intrusive alternative points away from necessity. If a contract contains independent services, necessity is assessed for each service. The Court accordingly treated personalisation as potentially useful but not necessarily indispensable to provide a social network.
The adopted advise examining the contract's substance, expectations and whether the service works without the processing. Terms cannot artificially expand necessity. Delivery details may qualify; behavioural advertising does not become necessary merely because it funds the service.
The Court confirmed that approach in Mousse, Case C-394/23: collecting every rail customer's title to personalise commercial communications was not objectively indispensable where generic, inclusive wording was a workable, less intrusive alternative.
When does legal obligation apply?
Article 6(1)(c) applies where processing is necessary to comply with a legal obligation to which the controller is subject. The controller should identify the actual provision, its territorial application and what it requires. A regulator's preference, industry practice, private contract or broadly worded risk policy is not automatically a legal obligation.
The processing must stay within what the rule requires. If tax law requires preserving specified invoice data for a set period, that may support that retention; it does not authorise unrelated profiling. Article 6(3) says that the basis for legal-obligation processing must be laid down in EU or Member State law, serve an objective of public interest and be proportionate. National law may specify data types, persons, disclosures, purposes, retention and safeguards.
When does public task apply?
Article 6(1)(e) covers processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller. It is not limited by its wording to public bodies, but the task or authority must have a legal foundation applicable to the controller:
“The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by” Union law or Member State law. —
The law need not prescribe every technical detail, but it must determine the purpose or establish the task. The controller should document the enabling rule and why each operation is necessary. Calling an initiative socially useful is not enough.
Public authorities performing their tasks cannot use Article 6(1)(f) legitimate interests for that processing. Their correct route will commonly be public task or legal obligation, depending on the governing law. Outside an official task, the facts require a separate analysis rather than an assumption that every public-body activity uses Article 6(1)(e).
When can legitimate interests be used?
Legitimate interests under Article 6(1)(f) requires a written, fact-specific assessment. In Meta Platforms, the Court described three cumulative conditions:
- identify a legitimate interest pursued by the controller or a third party;
- show the processing is necessary for that interest; and
- show that the person's interests, rights and freedoms do not override it.
Necessity asks whether the interest can reasonably be achieved just as effectively by less rights-restrictive means. It also works with data minimisation. Balancing should address the data's nature, scale and context; impacts and safeguards; the person's relationship with the controller; children's particular protection; and reasonable expectations at collection. Recital 47 says direct marketing may be a legitimate interest, not that all direct marketing automatically passes necessity and balancing.
In Koninklijke Nederlandse Lawn Tennisbond, Case C-621/22, the Court confirmed that a lawful commercial interest need not be created by legislation, but still must satisfy strict necessity and fact-specific balancing. Selling members' data to sponsors therefore did not become lawful merely because it generated revenue.
The assessment should name the interest precisely—“fraud prevention for card-not-present payments”, for example, rather than “business purposes”. It should record alternatives considered, likely benefits and harms, expectations, opt-outs, security, retention and the conclusion. The privacy notice must identify the pursued interest, and Article 21 may require stopping processing after an objection unless the controller demonstrates compelling overriding grounds; direct marketing must stop when objected to.
Additional gates and later changes
Article 6 does not neutralise other rules. Sensitive data need a separate Article 9(2) condition; Article 10 restricts conviction data; and ePrivacy or national sector rules may add requirements.
A controller also cannot relabel processing because its original basis becomes inconvenient. A new purpose requires purpose-limitation and Article 6(4) analysis unless based on new consent or qualifying law. The controller must test the new basis, update notices where required and preserve an auditable explanation.
Practical selection checklist
- What exact purpose and operation are being assessed?
- Is the processing genuinely optional, making valid consent workable?
- Is it objectively indispensable to perform a contract with this person?
- Which precise EU or Member State provision imposes a legal obligation?
- Which law creates the public task or official authority?
- For legitimate interests, what are the interest, necessity and balancing conclusions?
- Is there a less intrusive method that works as effectively?
- Do Articles 9 or 10, ePrivacy or national sector law add another gate?
- Are the basis, purpose, rights, retention and recipients correctly disclosed?
- Is the assessment documented and kept current as facts or purposes change?
Conclusion
The correct basis follows the real purpose and facts: genuine choice, objective contractual indispensability, a binding legal requirement, a legally grounded public task, or a legitimate interest that survives necessity and balancing. Choosing early and purpose by purpose keeps notices, rights and accountability coherent while exposing any additional data-law gate.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.