Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Article 6

Simply put

The evidence provided does not contain any material relevant to Article 6 of the GDPR, which is the provision governing the lawful bases for processing personal data. All supplied sources concern unrelated instruments, namely Article VI of the U.S. Constitution and Article 6 of the Paris Agreement, neither of which addresses data protection. A reliable definition cannot be generated from this evidence packet.

Formal definition

No definition of the GDPR's Article 6 can be produced from the supplied evidence. Sources 1, 3, 4, and 5 relate to Article VI of the U.S. Constitution (the Supremacy Clause and debt-validity provisions), and Source 2 relates to Article 6 of the Paris Agreement (international climate cooperation mechanisms); none of these addresses lawful bases for processing personal data. To draft an accurate entry on GDPR Article 6, which sets out the six legal bases for processing (consent, contract, legal obligation, vital interests, public task, and legitimate interests) and its interaction with Article 9 conditions for special category data, the reader should consult the current official text of the Regulation and authoritative regulatory guidance rather than this packet.

Why it matters

The evidence packet supplied for this entry does not contain any material about Article 6 of the GDPR. All five sources concern unrelated legal instruments: four relate to Article VI of the U.S. Constitution (the Supremacy Clause and the provision on the validity of pre-Constitution debts), and one relates to Article 6 of the Paris Agreement (international cooperation on climate change). None addresses the lawful bases for processing personal data under EU data protection law.

Because a glossary entry for a compliance audience must rest on accurate, on-point sourcing, no substantive explanation of why GDPR Article 6 matters can be generated from this packet without introducing unsupported claims. To produce a reliable entry, the reader should consult the current official text of the Regulation and authoritative regulatory guidance.

Who it's relevant to

Evidence limitation
This entry cannot identify the relevant audiences for GDPR Article 6 from the supplied sources, because those sources concern the U.S. Constitution and the Paris Agreement rather than data protection. Populating audience guidance here would require introducing claims not supported by the evidence digest.
Recommended next step
Readers seeking guidance on who is affected by the lawful bases for processing, such as controllers, data protection officers, compliance leads, and engineers, should refer to the current official text of the GDPR and authoritative regulatory guidance in place of this packet.

Inside Article 6

Lawfulness of processing
Article 6 sets out the requirement that processing of personal data must rest on at least one identified lawful basis. Without a valid basis, processing is generally unlawful.
Consent
One of the six lawful bases, under which the data subject has given permission for processing for one or more specific purposes. Consent is one option among several and is not a universal requirement for all processing.
Contract
A basis where processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the data subject's request prior to entering into a contract.
Legal obligation
A basis where processing is necessary for compliance with a legal obligation to which the controller is subject. The specific obligation typically derives from EU or member state law.
Vital interests
A basis where processing is necessary to protect the vital interests of the data subject or another natural person, generally applied in life-or-death or comparable situations.
Public task
A basis where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Legitimate interests
A basis where processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights of the data subject. Its availability can be constrained for certain controllers, such as public authorities acting in their tasks.
Relationship to special category data
Article 6 addresses the general lawful basis, but special category data attracts an additional requirement: a separate condition under Article 9 must also be satisfied alongside the Article 6 basis.
Member state and national law variation
The application of certain bases, particularly legal obligation and public task, can depend on EU or member state law, and national implementing law may vary the position. The UK GDPR follows a comparable structure under its own framework.

Common questions

Answers to the questions practitioners most commonly ask about Article 6.

Is consent always required to process personal data under Article 6?
No. Consent is only one of the six legal bases set out in Article 6, alongside contract, legal obligation, vital interests, public task, and legitimate interests. In many cases another basis will be more appropriate, and treating consent as a universal requirement is a common misconception. The correct basis depends on the context and purpose of the processing.
Does satisfying an Article 6 legal basis by itself make it lawful to process special category data?
No. An Article 6 basis is necessary but not sufficient for special category data. Such data generally requires an additional condition under Article 9 to be identified and satisfied. The two operate together, and identifying only an Article 6 basis leaves the processing of special category data without a complete lawful footing.
How should an organisation select the most appropriate Article 6 legal basis for a given processing activity?
Selection typically depends on the specific purpose, the relationship with the individual, and the nature of the processing. Each of the six bases has distinct conditions and consequences, so the choice should be assessed against the particular circumstances rather than applied by default. It is generally advisable to identify and document the basis before processing begins.
Can an organisation switch to a different Article 6 basis after processing has started?
Changing the legal basis after the fact is generally problematic, because the basis should be determined before processing and communicated to individuals, and different bases carry different rights and expectations. In most cases the position should be assessed carefully, and reliance on swapping bases as a fallback is not typically appropriate. Where uncertainty exists, verify against current guidance.
Where should the chosen Article 6 legal basis be recorded and communicated?
In practice, the legal basis is typically documented in internal records of processing and communicated to individuals through privacy information. The specific basis relied upon for each purpose should generally be stated so that individuals can understand how their data is used and which rights apply. The exact disclosure obligations should be checked against the applicable transparency requirements.
How does the choice of Article 6 basis affect the rights available to individuals?
The applicable data subject rights can vary with the legal basis relied upon, so the choice of basis has practical consequences beyond lawfulness. Because different bases interact differently with rights such as objection and portability, the implications should be assessed for each basis in context rather than assumed to be uniform.

Common misconceptions

Consent is always required to process personal data.
Consent is only one of six lawful bases under Article 6. In many cases another basis, such as contract, legal obligation, or legitimate interests, is more appropriate. Relying on consent where a different basis is a better fit can create unnecessary compliance risk.
Identifying an Article 6 basis is sufficient for any type of personal data.
For special category data, an Article 6 basis alone is not enough. An additional condition under Article 9 must generally also be met, so two distinct requirements must be satisfied.
Legitimate interests is a catch-all basis that permits any processing the controller wants.
Legitimate interests requires that processing be necessary for those interests and that they are not overridden by the data subject's interests or fundamental rights, which typically calls for a documented balancing assessment. Its use can also be restricted for certain controllers, such as public authorities in the exercise of their tasks.

Best practices

Identify and document the specific Article 6 lawful basis for each distinct processing purpose before processing begins, rather than defaulting to consent.
Where legitimate interests is relied on, conduct and record a balancing assessment weighing the interest pursued against the interests and fundamental rights of the data subject.
For any special category data, confirm and document both an Article 6 basis and an additional Article 9 condition, treating them as separate requirements.
Match the basis to the actual relationship and purpose, for example using contract for processing genuinely necessary to deliver a service and legal obligation only where a real legal duty applies.
Check whether the relevant basis depends on EU or member state law, and verify the position against applicable national implementing law, noting that it may differ under the UK GDPR.
Review chosen lawful bases periodically and when purposes change, since a basis appropriate for one processing activity is not automatically valid for another.