Category: Lawful Basis for Processing

Public Interest Task

Also known as: Public Task, Task Carried Out in the Public Interest, Public Task Basis

Simply put

The public interest task is one of the legal reasons an organisation can rely on to use personal data under data protection law. It generally applies where processing is necessary to carry out a task in the public interest or to exercise official authority. It is most relevant to public authorities, but in some cases can apply to other organisations that perform such tasks or exercise official authority.

Formal definition

The 'performance of a task carried out in the public interest or in the exercise of official authority vested in the controller' is a lawful basis for processing under Article 6(1)(e) of the GDPR (and the UK GDPR), commonly referred to by the ICO as the 'public task' basis. It covers processing that is necessary for such a task and is most relevant to public authorities, though ICO guidance indicates it may extend to any organisation that exercises official authority or carries out a specific task in the public interest. As a distinct Article 6 basis, it does not require consent; the relevant task or authority should generally have a clear basis in law, and member state or UK national implementing law may specify further conditions. The precise scope and evidential requirements are subject to assessment and to applicable regulatory guidance, and readers should verify the current position against the official text and ICO guidance. Where special category data under Article 9 is involved, an additional Article 9 condition is required beyond this Article 6 basis.

Why it matters

The public task basis is one of the six lawful bases under Article 6(1)(e) of the GDPR and UK GDPR, and it functions quite differently from consent. For public authorities and other organisations that carry out functions in the public interest or exercise official authority, relying on this basis means processing does not depend on obtaining and maintaining an individual's consent. This matters because consent can be withdrawn and can be impractical or inappropriate where a body must carry out its statutory or public functions regardless of individual preference. Choosing the correct lawful basis at the outset is important, as it is generally difficult to switch bases later, and the basis chosen affects which data subject rights apply.

According to ICO guidance, the public task basis is most relevant to public authorities, but it can apply to any organisation that exercises official authority or carries out a specific task in the public interest. This means the boundary of who can rely on it is not always obvious and is subject to assessment. Organisations that assume they qualify without a clear underlying basis in law for the relevant task or authority may find their reliance on this basis challenged. The precise scope and evidential requirements are context dependent and should be verified against the current official text and ICO guidance.

A further point of caution is that the Article 6(1)(e) basis does not, on its own, permit processing of special category data. Where special category data under Article 9 is involved, an additional Article 9 condition is required. Treating the public task basis as sufficient in isolation for sensitive data would be a significant compliance gap, and the position may be further shaped by member state or UK national implementing law.

Who it's relevant to

Public authorities

Public authorities are the category for whom the public task basis is most relevant, according to ICO guidance. Where processing is necessary for the performance of their public interest tasks or the exercise of official authority vested in them, this basis will often be the appropriate lawful basis rather than consent. The specific task or authority should generally have a clear basis in law.

Non-public organisations exercising official authority or public functions

ICO guidance indicates the basis can apply to any organisation that exercises official authority or carries out a specific task in the public interest, not only public authorities. Such organisations should assess carefully whether their functions genuinely fall within scope, as this determination is context dependent and subject to regulatory guidance.

Data protection officers and compliance leads

Those responsible for selecting and documenting lawful bases need to distinguish the public task basis from other Article 6 bases such as consent and legitimate interests, and to record why it applies. They should also confirm whether any special category data is involved, which would require an additional Article 9 condition, and check for further conditions under member state or UK national implementing law.

Legal advisers assessing the basis in law

Lawyers advising on reliance on Article 6(1)(e) should examine whether the relevant task or official authority has a sufficient basis in law and how national implementing law shapes its scope. Because the precise evidential requirements are subject to assessment and evolving guidance, advice should be grounded in the current official text and ICO guidance rather than treated as settled.

Inside Public Interest Task

Public task legal basis (Article 6(1)(e))

One of the six lawful bases under Article 6 of the GDPR, permitting processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It is a distinct basis and should not be treated as interchangeable with consent or legitimate interests.

Basis in law requirement

Reliance on the public task basis generally requires that the underlying task or authority be laid down in EU or member state law. The GDPR does not itself create the task; it points to other legal instruments, so the specific grounding will vary between member states and under UK GDPR and national implementing law.

Necessity test

The processing must be necessary for the relevant public interest task, meaning it should be a targeted and proportionate way of achieving the purpose rather than merely convenient. What is necessary is subject to assessment in each context.

Typical users of the basis

This basis is most commonly relied upon by public authorities and bodies exercising official functions, though in some cases private organisations carrying out functions grounded in law may also rely on it. The precise scope depends on the applicable national framework.

Interaction with special category data

Where processing involves special category data under Article 9, the public task basis under Article 6 is not sufficient on its own; an additional Article 9 condition must also be identified. The two requirements operate cumulatively.

Effect on individual rights

The choice of the public task basis affects which data subject rights apply and how they operate. For example, the availability of the right to erasure and the right to data portability is generally shaped by the legal basis relied upon, and readers should verify the position against the current official text.

Common questions

Answers to the questions practitioners most commonly ask about Public Interest Task.

Does relying on the public interest task basis mean I do not need consent from individuals?

Generally, yes in the sense that public task under Article 6(1)(e) is a distinct legal basis from consent under Article 6(1)(a), and you should rely on only one Article 6 basis for a given processing activity. Where public task applies, consent is typically not the appropriate basis and asking for consent you would not honour can be misleading. However, this does not remove other obligations, and processing of special category data still requires a separate Article 9 condition. The correct basis depends on your role and function, so this should be assessed case by case.

Is the public interest task basis available only to public authorities?

Not necessarily. While this basis is most commonly relied upon by public authorities, Article 6(1)(e) can in principle apply to a task carried out in the public interest or in the exercise of official authority vested in the controller, which may include private bodies exercising such functions. The availability and scope can be affected by member state law and, in the UK, by national implementing legislation, so divergence is possible and you should verify the position against the applicable law.

What underpinning must I have in place before relying on the public interest task basis?

In most cases this basis needs to be grounded in a legal underpinning that establishes the relevant task or official authority, which may derive from EU or member state law. You should identify and document the specific function or power you are relying on, rather than asserting a general public benefit. The precise requirements can vary between member states and under UK law, so confirm against the applicable legal framework.

How does the right to object interact with processing based on public interest task?

Where you rely on Article 6(1)(e), data subjects generally have a right to object, and you must stop processing unless you can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms, or the processing relates to legal claims. This differs from bases where the objection right does not apply in the same way, so you should build a process to handle and assess such objections.

Do I need a Data Protection Impact Assessment when relying on this basis?

A DPIA under Article 35 is triggered by the risk profile of the processing, not by the choice of legal basis alone. Relying on public task does not by itself require or exclude a DPIA. You should assess whether the processing is likely to result in a high risk to individuals and carry out a DPIA where that threshold is met, subject to your own risk assessment.

How should I document my reliance on the public interest task basis?

You should typically record the specific basis relied upon, the task or official authority underpinning it, and how you have concluded that the processing is necessary for that task. Where special category data is involved, document the additional Article 9 condition separately. Transparency information provided to individuals should generally reflect the basis and, where applicable, the right to object. Retain this documentation as part of your accountability records.

Common misconceptions

Consent is always needed, so the public task basis is a weaker fallback.

Consent is only one of six Article 6 bases and is not a universal requirement. The public task basis is a distinct and equally valid lawful basis, and for public authorities exercising official functions it will often be more appropriate than consent, subject to assessment.

Only public authorities can ever rely on the public task basis.

While public authorities and bodies are the most typical users, in some cases private organisations carrying out a task grounded in EU or member state law may rely on it. The precise availability depends on the applicable national implementing law and can vary between member states.

Identifying the public task basis under Article 6 is enough for any dataset.

For special category data under Article 9, the Article 6 public task basis is not sufficient by itself; a separate Article 9 condition must also be satisfied. The two requirements apply cumulatively.

Best practices

Identify and document the specific EU or member state law that grounds the task before relying on Article 6(1)(e), rather than assuming the GDPR itself creates the authority.

Carry out and record a necessity and proportionality assessment showing why the processing is a targeted means of achieving the public interest purpose.

Where special category data is involved, separately identify and document an appropriate Article 9 condition in addition to the Article 6 basis.

Map how the chosen basis affects data subject rights, in particular noting where rights such as erasure and portability may be shaped or limited by reliance on this basis.

Confirm the position under the specific applicable regime, distinguishing EU GDPR, UK GDPR, and relevant national implementing law, as member state derogations can vary the outcome.

Verify article references, the precise scope of the task, and any relevant guidance against the current official text before finalising compliance documentation.