The six permissions in the GDPR
Every processing of personal data needs a reason from a list of six. The list is exhaustive, the reasons rank equally – and the choice cannot be swapped out later.
The GDPR works as a prohibition with a reservation of permission: without permission, processing is forbidden. It is allowed only where exactly one of six grounds applies. That reversal surprises many people – normally, whatever is not forbidden is allowed.
The six grounds, from common to rare
- ContractWhatever performance requires: delivery address, invoice, login. Not a contract about advertising.
- Legitimate interestsRequires a balancing test that has to be documented. Does not carry access to the terminal device.
- ConsentFreely given, informed, unambiguous – and revocable at any time. The ground behind the consent banner.
- Legal obligationTax retention periods, for instance. The duty has to follow from law, not from a contract.
- Public taskFor public authorities and bodies with delegated powers. Practically never relevant for a company.
- Vital interestsThe emergency: life and health. On a website, almost never relevant.
One purpose, one ground
The legal basis attaches to the purpose, not to the record. The same e-mail address can rest on the contract for sending an order confirmation and on consent for a newsletter. Two purposes, two grounds, two separate decisions.
From this follows the most common mistake in practice: a purpose is quietly extended by a second one – order handling becomes advertising – without a ground of its own for the new purpose.
What rests on what on a typical website
Two grounds side by side
The right-hand column is shorter than many expect. That is because "useful for running the site" and "strictly necessary for the service requested" are two different standards. The second is narrow, and it is judged from the perspective of the person opening the page.
The choice has to be stated
The legal basis chosen is not an internal note. It belongs in the privacy notice, named for each purpose. A notice listing all six grounds and leaving open which applies to what does not meet the duty to inform – it merely shifts the work onto the reader.