# GDPR legal basis assessment
> Source: https://legalcode.md/skills/legalcode-gdpr-legal-basis-assessment | [HTML version](https://legalcode.md/skills/legalcode-gdpr-legal-basis-assessment)

Systematically assess the appropriate GDPR Article 6 lawful basis for any processing activity — covering consent (Art. 6(1)(a)), contract performance (Art.…

Systematically assess the appropriate GDPR Article 6 lawful basis for any processing activity — covering consent (Art. 6(1)(a)), contract performance (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), vital interests (Art. 6(1)(d)), public task (Art. 6(1)(e)), and legitimate interests (Art. 6(1)(f)). Use when selecting a legal basis for new processing, auditing an existing legal basis for GDPR/UK GDPR compliance, refreshing invalidated consent, evaluating basis changes, or building a legal basis register integrated with ROPA requirements. Covers Article 9 special category processing conditions, Article 10 criminal conviction and offence data, and children's data under Article 8. Evaluates each candidate basis against adequacy criteria, identifies where multiple bases apply or conflict, flags basis-switching risks, documents downstream data subject rights per basis, and produces a legal basis register ready for ROPA population. EU/UK GDPR primary scope; Swiss FADP and multi-regime annotations included. Produces ADEQUATE / REQUIRES REVIEW / INADEQUATE per-basis classifications and APPROVED / CONDITIONAL / REJECTED overall outcomes with Glass Box audit trail.

This skill determines the correct GDPR lawful basis for any personal data processing activity, documents the adequacy assessment rationale, and produces a legal basis register entry ready for integration with the organisation's Records of Processing Activities (RoPA). A lawful basis is the legal foundation that makes data processing permissible under GDPR. Selecting the right basis is not merely a compliance checkbox — it determines which data subject rights apply, whether processing can continue if circumstances change, and what documentation must be maintained. Wrong basis selection is the **single most fined GDPR violation category**, with enforcement actions including Meta €390M (Irish DPC, January 2023), LinkedIn €310M (Irish DPC, October 2024), and Meta €479M (Spanish AEPD, 2025) all stemming from improperly applied or switched legal bases. **Covers:** - Adequacy assessment of all six Art. 6(1) lawful bases (a through f) - Screening triage to identify viable candidate bases quickly - Deep-dive analysis per viable basis: eligibility criteria, necessity test, and proportionality/balancing assessment (where applicable) - Per-basis classification (ADEQUATE / REQUIRES REVIEW / INADEQUATE) - Overall legal basis determination (APPROVED / CONDITIONAL / REJECTED) - Article 9 special category data overlay — 10 conditions under Art. 9(2) - Article 10 criminal conviction and ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*