Lawful Basis

There are six Lawful basis for processing personal data – in order to process any personal data you must have a valid lawful basis.

1. Contract – processing data to fulfil a contractual obligation to a data subject or provide a quote.
2. Legal Obligation – if you need to process the personal data to comply with common law or statutory obligation.
3. Vital interests – if you need to process data to protects someone’s life
4. Public Task – in the exercise of official authority
5. Legitimate interest - Processing is necessary for your organisation’s legitimate interests or those of a third party
6. Consent - clear permission has been given for you to process their personal data for a specific purpose.

To help you to identify which is the most appropriate basis for processing your data the Information Commissioners Officer has a large amount of information and support.

Lawful basis interactive tool

A guide to Lawful basis

Legitimate interest

Legitimate interests is the most flexible lawful basis for processing – it will not always be appropriate and you can use the aforementioned interactive tool from the ICO to check. Legitimate interest will be appropriate to cover things like:

• Communicating with volunteers about their role and upcoming activities
• Sending information to donors and supporters about your charitable activities
• Retaining information to feedback your impact to funders
• Storing client data to ensure there is a record of support that is given

Legitimate interests is not focused on a particular purpose and therefore gives you more scope to potentially rely on it in many different circumstances.

It may be the most appropriate basis when:

• the processing is not required by law but is of a clear benefit to you or others;
• there’s a limited privacy impact on the individual;
• the individual should reasonably expect you to use their data in that way; and
• you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.

The three part test

To ascertain whether legitimate interest is the right basis for a particular instance of data processing you should apply the three part test:

• Purpose test: are you pursuing a legitimate interest?
• Necessity test: is the processing necessary for that purpose?
• Balancing test: do the individual’s interests override the legitimate interest?

To help apply this test you can use the Legitimate Interest Assessment form from the ICO.