{"id":41028,"date":"2026-09-22T10:00:00","date_gmt":"2026-09-22T10:00:00","guid":{"rendered":"https:\/\/grapenordic.com\/?p=41028"},"modified":"2026-11-11T09:30:27","modified_gmt":"2026-11-11T09:30:27","slug":"gdpr-article-6-lawful-basis","status":"publish","type":"post","link":"https:\/\/grapenordic.com\/en\/gdpr-article-6-lawful-basis\/","title":{"rendered":"When may you process personal data under GDPR?"},"content":{"rendered":"\n

You may process personal data when you have a lawful basis for doing so. GDPR Article 6 lists six: consent, contract, legal obligation, vital interests, tasks in the public interest and legitimate interests. At least one of them has to fit each processing activity, and you need to know which one before you begin.<\/p>\n\n\n\n

It sounds legal, but the question comes up all the time in ordinary work. May we keep this application? May I send the customer list to the agency? May we post the photo from the summer party on social media? Each time, the answer depends on which basis applies.<\/p>\n\n\n\n

The six bases in GDPR Article 6<\/h2>\n\n\n\n
Basis<\/th>Short explanation<\/th>Workplace example<\/th><\/tr><\/thead>
Consent (point a)<\/td>The person has said yes to a specific purpose<\/td>A portrait photo of an employee on the website<\/td><\/tr>
Contract (point b)<\/td>Necessary to perform an agreement with the person<\/td>Name and address to deliver an order, bank details to pay a salary<\/td><\/tr>
Legal obligation (point c)<\/td>The law requires it<\/td>Reporting salaries to the tax authorities, keeping vouchers under bookkeeping law<\/td><\/tr>
Vital interests (point d)<\/td>Necessary to protect life or health<\/td>Information given to paramedics after a workplace accident<\/td><\/tr>
Public interest or official authority (point e)<\/td>Tasks carried out by authorities under legislation<\/td>Casework at a public authority<\/td><\/tr>
Legitimate interests (point f)<\/td>The company has a legitimate interest that outweighs the person’s<\/td>Contact details for a customer’s buyer, the office access log<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The full wording is in the General Data Protection Regulation<\/a>. Below are the four that private companies use most.<\/p>\n\n\n\n

Contract<\/h3>\n\n\n\n

This is the most used and least discussed basis. When a customer orders a product, you may process the information needed to deliver and invoice. When you hire an employee, you may process what is needed to perform the employment contract.<\/p>\n\n\n\n

The limit lies in the word necessary. The delivery address is necessary to send the parcel. The date of birth usually is not.<\/p>\n\n\n\n

Legitimate interests<\/h3>\n\n\n\n

This is the flexible basis, and the one that takes the most thought. You have to be able to answer three questions: Do we have a legitimate interest? Is the processing necessary to pursue it? And do the person’s interests outweigh ours?<\/p>\n\n\n\n

You make that balancing test before you begin, and you should write it down. Keeping email correspondence with a supplier’s contact person normally comes out in the company’s favour. Monitoring employees’ private internet use in detail normally does not.<\/p>\n\n\n\n

Public authorities cannot rely on legitimate interests when carrying out their official tasks.<\/p>\n\n\n\n

Consent<\/h3>\n\n\n\n

Many people think consent is the main rule. It is one of six bases and often the most cumbersome. Valid consent has to be freely given, specific, informed and unambiguous, and it can be withdrawn at any time. When that happens, the processing has to stop.<\/p>\n\n\n\n

Consent is therefore poorly suited to processing the company has to carry out in any case. You cannot ask an employee to consent to the processing of salary information, because you cannot stop paying salaries if the consent is withdrawn. The basis there is contract and legal obligation.<\/p>\n\n\n\n

Section 12 of the Danish Data Protection Act allows consent to be used in employment, but the Danish Data Protection Agency has pointed out that the dependency between employer and employee can make it hard to show that consent is freely given. It is mostly used for things the employee can truly decline without consequences, such as photos for marketing.<\/p>\n\n\n\n

This applies even when the basis is in order<\/h2>\n\n\n\n

A lawful basis is necessary, but it is not enough. The basic principles in Article 5 always apply. The information may only be used for the purpose it was collected for. You may only hold what is necessary. It has to be accurate, it has to be deleted when the purpose has been fulfilled, and it has to be protected.<\/p>\n\n\n\n

A customer’s email address collected to send an order confirmation may therefore not simply be used for newsletters. That is a new purpose, and email marketing generally requires consent under marketing law.<\/p>\n\n\n\n

Sensitive information requires more<\/h2>\n\n\n\n

Health information, trade union membership, religion and the other special categories are prohibited to process as a starting point. Here you need an exception in Article 9 in addition to a basis in Article 6. For Danish national ID numbers and information about criminal offences, there are special rules in the Danish Data Protection Act. We go through the differences in the article on ordinary and sensitive personal data<\/a>.<\/p>\n\n\n\n

Three mistakes that keep recurring<\/h2>\n\n\n\n

Consent as a safety net.<\/strong> The company asks for consent to something it already has the right or the duty to do. That confuses people and gives the person the impression of a choice that does not exist.<\/p>\n\n\n\n

Reuse for new purposes.<\/strong> Information collected for one purpose is used for another without a new assessment. The participant list from a webinar ends up in the sales team’s call list.<\/p>\n\n\n\n

Nobody knows what the basis is.<\/strong> The processing has been running for years, and nobody has taken a position. The basis has to appear in the company’s record of processing and in the information given to data subjects, so it must be possible to look it up.<\/p>\n\n\n\n

What employees need to know<\/h2>\n\n\n\n

Very few employees need to be able to quote Article 6. They need to recognise the situations where the question arises and know who to ask. Typically, that is when they:<\/p>\n\n\n\n