Legal and compliance
What is Lawful basis?
The justification a business relies on to process personal data at all. Under GDPR there are six, and one must apply before processing begins. Picking a basis retrospectively to justify something already happening is the failure pattern regulators describe most often.
Also called: legal basis for processing
The six, in the order a small site meets them
- Consent
- Freely given, specific, informed, withdrawable. Required for marketing email and non-essential cookies.
- Contract
- Necessary to deliver what someone ordered — an address to ship to.
- Legal obligation
- Tax records, statutory retention of invoices.
- Legitimate interests
- Your interest balanced against theirs, documented. Common for fraud prevention and basic security logging.
- Vital interests
- Life-or-death. Rare outside healthcare.
- Public task
- Official functions. Rare outside the public sector.
Why the choice matters afterwards
The basis determines which rights apply. Consent-based processing carries a right to withdraw and a right to erasure; contract-based processing carries a right to portability. Choosing a basis is not a formality — it decides what you must be able to do when someone asks.
The common mistake
Relying on consent for something you would do anyway, such as sending an order confirmation. If you cannot honour a withdrawal, consent was the wrong basis, and contract was the right one from the start.
Where this is covered in depth
A definition can only go so far. Who actually owns your website — a checklist you can verify today covers this properly — 3 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.