YTYK You think you know

Card 1 of 18 Lawful basis ●○○ Foundational

Six lawful bases, no hierarchy

Processing is lawful if one of the six bases in Article 6(1) applies: consent, contract, legal obligation, vital interests, public task, or legitimate interests. No basis outranks another, and you pick one per purpose before you start.

Why it is like this

The regulation forbids processing by default and then lists the ways back in. Making the bases equal keeps organisations from treating one as a universal key — and forces the choice to be made against the actual purpose.

Not to be confused with

A menu you can switch between later. The basis is disclosed to the data subject at collection and determines which rights apply, so swapping consent for legitimate interests when consent is withdrawn is not a repair — it is a second breach.

In practice

Payroll runs on legal obligation. The company newsletter runs on consent. Fraud screening typically runs on legitimate interests. Same company, three bases.

Source: Regulation (EU) 2016/679 (GDPR) — Article 6(1). Read on .

Predict Check yourself

A service collected marketing consent, and a user withdraws it. The team proposes keeping the emails flowing under legitimate interests. What happens?

  1. Not allowed — the basis is fixed per purpose at the outset; you cannot swap to a second one to survive a withdrawal.
  2. Allowed — legitimate interests is available whenever consent fails.
  3. Allowed for 30 days, as a transition period.
  4. Allowed if the privacy notice listed both bases.
Show the answer

Not allowed — the basis is fixed per purpose at the outset; you cannot swap to a second one to survive a withdrawal.

Withdrawal has to be as easy as giving consent and must actually stop the processing. A fallback basis would make the right meaningless, which is why the EDPB treats basis-swapping as unlawful rather than clever.