A legal basis is the lawful ground that authorises a controller to process personal data. Without a valid legal basis, the processing of personal data is unlawful.
Legal bases under the GDPR
Article 6 of the GDPR defines six legal bases:
- Consent – The data subject has given consent to the processing
- Performance of a contract – Processing is necessary for the performance of a contract
- Legal obligation – Processing is required by law
- Vital interests – Protection of life or health
- Public interest – Performance of a task carried out in the public interest
- Legitimate interest – Legitimate interests of the controller or a third party
Legal basis for cookies
Different legal bases are used for different types of cookies:
- Essential cookies – Performance of a contract or legitimate interest
- Analytics cookies – Consent (or legitimate interest in some cases)
- Marketing cookies – Always consent
Choosing a legal basis
The controller must determine and document the legal basis before processing begins. The legal basis cannot be changed during processing. For cookies, consent is the most common and safest basis.