| name | lawful-basis-assessment |
| title | Implementing Lawful Basis Assessment |
| description | Guides determination of the correct lawful basis under GDPR Article 6(1)(a)-(f) for each processing activity. Includes decision tree logic for consent vs legitimate interest vs contract necessity. Activate when evaluating legal grounds for processing or reviewing lawful basis selections. Keywords: lawful basis, Article 6, consent, legitimate interest, legal obligation, contract. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/lawful-basis-assessment |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Implementing Lawful Basis Assessment
Overview
Every processing activity under GDPR must have a valid lawful basis established before processing begins. Article 6(1) provides six mutually non-exclusive bases. Selecting the wrong basis creates compliance risk, may invalidate the processing entirely, and can result in enforcement action. This skill provides a systematic methodology for evaluating and documenting the appropriate lawful basis.
The Six Lawful Bases — Art. 6(1)
(a) Consent
The data subject has given consent to the processing of their personal data for one or more specific purposes.
Requirements per Art. 7 and Recital 32:
- Freely given: genuine choice, no imbalance of power, no conditionality (Art. 7(4))
- Specific: granular consent for distinct processing purposes
- Informed: clear plain language about identity, purpose, data types, rights
- Unambiguous: clear affirmative action (no pre-ticked boxes, no silence)
- Withdrawable: as easy to withdraw as to give (Art. 7(3))
Best suited for: Marketing communications, cookies/tracking, research participation, sharing data with third parties for their own purposes.
Not appropriate when: There is a power imbalance (employer-employee, public authority-citizen), processing is necessary for another basis, or withdrawal would be impractical.
(b) Contract Performance
Processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject's request prior to entering into a contract.
Key test: Would the contract be impossible to perform without this specific processing? The processing must be objectively necessary, not merely useful or standard practice.
Best suited for: Delivering purchased goods, processing payments, providing contracted services, pre-contractual enquiries at the data subject's request.
Not appropriate when: Processing is useful but not necessary for the contract (e.g., profiling customers is not necessary to deliver their order).
(c) Legal Obligation
Processing is necessary for compliance with a legal obligation to which the controller is subject.
Requirements:
- The obligation must be laid down by EU or Member State law (not contractual obligations)
- The law must be sufficiently clear about the processing required
- The processing must be limited to what is necessary to comply
Best suited for: Tax reporting, employment law obligations, anti-money laundering checks, regulatory reporting, court orders.
