Lawful basis: the question to answer before you collect anything

Under most modern privacy law you may not process personal data because it seemed useful. You need a reason from a closed list, chosen before you start, and recorded — and the choice has consequences, because each basis comes with a different set of rights for the person and a different route out if they object.

The six grounds for a lawful basis

• Consent — freely given, specific, informed and withdrawable, which is a higher bar than a pre-ticked box.
• Contract — necessary to deliver what the person asked for, which covers most ordinary customer processing.
• Legal obligation — you are required by law to hold it, as with tax and employment records.
• Vital interests — rare, and essentially about life-threatening situations.
• Public task — for authorities and those exercising official functions.
• Legitimate interests — your own or a third party's, where they are not overridden by the person's rights, and where you have actually done the balancing.

Why consent is usually the wrong choice

Because it is the weakest ground you can stand on. Consent can be withdrawn at any moment, and when it is you must stop and usually delete — which is impossible if the processing is something you have to do anyway, like keeping an invoice for seven years. Relying on consent for processing that is genuinely necessary creates a promise you cannot keep, and the regulator's view is that asking for consent you do not need is itself misleading. For normal customer work the basis is contract; for record-keeping it is legal obligation; consent belongs to things the person can genuinely say no to, like marketing.

One basis per purpose, not per dataset. The same email address can be held under contract for delivering the service and under consent for a newsletter, and swapping basis later because the first one became inconvenient is not permitted.

Recording the decision

1. Write the purpose first, specifically — "marketing" is not a purpose, "sending a monthly product email to people who asked for it" is.
2. Pick the basis for that purpose and record why, in a sentence, at the time rather than afterwards.
3. For legitimate interests, document the balancing: your interest, the impact on the person, and why it does not override them.
4. State the basis in the privacy notice, since the person is entitled to know which one you relied on.
5. Revisit when the purpose changes — a new use of existing data is a new decision, not an extension of the old one.
6. Keep the record with the retention period and the owner, because all three answer the same regulatory question.

Where this gets companies caught

Almost never in the choice itself and almost always in the absence of a record. Asked which basis applies to a particular activity, most small organisations can construct a defensible answer on the spot — but constructing it on the spot is the finding, because the law requires the determination to have been made before processing began. A short table of purpose, basis, reason and date is the whole compliance artefact, and it takes an afternoon.

Ettex Records holds that table beside the inventory of what personal data you actually have, which keeps the two halves of the same question together. The basis also drives the answer when somebody exercises a right, because what you must do with a subject access request or an objection depends on which ground you relied on.