United Kingdom — Lawful Bases for Processing

Update after Data (Use and Access) Act 2025 and SI 2026/82: Seven lawful bases

Effective from February 2026, pursuant to the Data (Use and Access) Act 2025 and the Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2026 (SI 2026/82), Article 6 of the UK GDPR now provides for seven lawful bases for processing personal data. This reflects the formal commencement of amendments introducing the new basis for “recognised legitimate interests.” Controllers must continue to identify and document at least one lawful basis before processing any personal data; failure to do so renders processing unlawful and activates individual rights (including erasure).

The seven lawful bases (current law, from February 2026):

(a) Consent — The data subject has given consent to the processing for one or more specific purposes.

(b) Contract — Processing is necessary for the performance of a contract to which the data subject is party, or for steps at the data subject’s request before entering into a contract.

(c) Legal obligation — Processing is necessary for compliance with a legal obligation imposed on the controller by domestic law.

(d) Vital interests — Processing is necessary to protect the vital interests of the data subject or another natural person. (Interpreted strictly: urgent, life-and-death situations.)

(e) Public task — Processing is necessary for the performance of a task carried out in the public interest or the exercise of official authority vested in the controller, founded in domestic law. (See DPA 2018 s.8 for elaboration.)

(f) Legitimate interests — Processing is necessary for the legitimate interests of the controller or a third party (except where overridden by the data subject’s interests or rights). Not available to public authorities performing public tasks. Requires a balancing test and documentation (Legitimate Interests Assessment, LIA).

(ea) Recognised legitimate interests — New from 2025, commenced February 2026: Processing is necessary for a "recognised legitimate interest" listed in Annex 1 of the UK GDPR (e.g., crime prevention, safeguarding, emergency response, national security, and disclosures to public authorities). This basis does not require the controller to carry out an individual balancing test—the public interest justification is determined by Parliament. The list of recognised interests may be amended by the Secretary of State by regulation. Not available to public authorities performing public functions.

No hierarchy and interplay

There is no hierarchy among the bases: controllers must select the most appropriate basis for each purpose and document their rationale. The choice of lawful basis affects which data subject rights apply. Processing special category or criminal-offence data also requires a separate Article 9 or Article 10 condition.

What changed

Effective from February 2026, the addition of Article 6(1)(ea) and its commencement, introduces a seventh lawful basis, “recognised legitimate interests.” This reflects the final step of amendments made by the Data (Use and Access) Act 2025 and brings statutory guidance, the UK GDPR, and ICO publications into alignment.

Source: UK GDPR Article 6, as last amended Source: Data (Use and Access) Act 2025, section 70 Source: SI 2026/82 (commencement and transitional) Source: UK GDPR Annex 1 — Recognised legitimate interests Source: ICO, Guide to the UK GDPR — Lawful basis

Article 9(1) UK GDPR prohibits the processing of special-category personal data—that is, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation. Processing is permitted only if the controller identifies both an Article 6 lawful basis and one of ten conditions set out in Article 9(2).

Article 9 conditions operate as an additional layer of protection, not as a replacement for Article 6 lawful bases. The ICO guidance states that the choice of Article 6 lawful basis does not dictate which Article 9 condition applies, and vice versa; they are independent. Controllers must identify and document both.

The ten Article 9(2) conditions

Five conditions stand alone under Article 9(2); five others require an additional basis in UK domestic law, set out in Schedule 1 of the Data Protection Act 2018.

(a) Explicit consent The data subject has given explicit consent to the processing for one or more specific purposes. Article 9(2)(a) does not define "explicit," but ICO guidance interprets it to mean consent that is express, clear, and specific—for example, a signed statement or an opt-in to a clearly worded tick-box. The ICO notes that for many Article 9 conditions, controllers should be prepared to justify why explicit consent cannot be obtained.

(b) Employment, social security and social protection (if authorised by law) Processing is necessary for the purposes of carrying out obligations or exercising rights under employment, social security, or social protection law. Section 10(2) of the Data Protection Act 2018 requires that to rely on this condition, the controller must also meet Part 1, paragraph 1 of Schedule 1 to the DPA 2018, which requires that the processing be necessary for such purposes and that the processing is authorised by an enactment or rule of law or is necessary to comply with a legal obligation. Schedule 1, paragraph 5 requires the controller to maintain an appropriate policy document (APD).

(c) Vital interests Processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent. ICO guidance interprets this narrowly: it applies to matters of life and death, such as emergency medical treatment where the individual is unconscious or otherwise incapable of giving consent. The condition is not available if the individual is capable of consenting, even if they refuse.

(d) Not-for-profit bodies Processing is carried out by a foundation, association, or other not-for-profit body with a political, philosophical, religious, or trade union aim, in the course of its legitimate activities, with appropriate safeguards, and relates only to current or former members (or persons with regular contact related to that purpose). Article 9(2)(d) requires that the data not be disclosed outside the body without the data subject's consent.

(e) Made public by the data subject Processing relates to personal data which are manifestly made public by the data subject. The term "manifestly made public" is not defined in the UK GDPR. ICO guidance interprets this as assuming a deliberate act by the individual: it is not enough that the data is already in the public domain—the data subject must have taken the steps that made it public. The ICO confirms that even when this condition applies, controllers remain subject to all other UK GDPR obligations, including fairness, transparency, and respect for data-subject rights.

(f) Legal claims or judicial acts Processing is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity. ICO guidance states that "legal claims" in this context is not limited to current litigation but includes prospective or potential proceedings. No DPA Schedule 1 condition or APD is required.

(g) Reasons of substantial public interest (with a basis in law) Processing is necessary for reasons of substantial public interest, based on UK domestic law which is proportionate to the aim pursued and respects the essence of the right to data protection. Section 10(3) of the Data Protection Act 2018 requires that to rely on this condition, the controller must meet one of 23 specific substantial public interest conditions set out in Part 2 of Schedule 1 to the DPA 2018 (paragraphs 6 to 28). These include statutory and government purposes, administration of justice, equality of opportunity or treatment, preventing or detecting unlawful acts, protecting the public, regulatory requirements, journalism and academia, preventing fraud, and safeguarding children or individuals at risk. Schedule 1, paragraph 5 requires an APD for most of these conditions.

(h) Health or social care (with a basis in law) Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, based on UK domestic law or a contract with a health professional. Section 10(2) of the DPA 2018 provides that the relevant basis in UK law is Part 1, paragraph 2 of Schedule 1 to the DPA 2018. Article 9(3) UK GDPR and section 11 of the DPA 2018 require that processing be carried out by or under the responsibility of a professional subject to the obligation of professional secrecy under UK law or rules established by national competent bodies (such as a doctor, nurse, or social worker) or another person subject to an equivalent duty of confidentiality. Schedule 1, paragraph 5 requires an APD.

(i) Public health (with a basis in law) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and medicinal products or medical devices, based on UK domestic law which provides for suitable and specific measures to safeguard data-subject rights, in particular professional secrecy. Recital 54 UK GDPR clarifies that "public health" includes health status, morbidity, disability, health determinants, and health-care outcomes. Section 10(2) of the DPA 2018 provides that the relevant basis in UK law is Part 1, paragraph 3 of Schedule 1 to the DPA 2018, which requires processing to be carried out by or under the responsibility of a health professional or another person owing a legal duty of confidentiality. Schedule 1, paragraph 5 requires an APD.

(j) Archiving, research and statistics (with a basis in law) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) UK GDPR, based on UK domestic law which is proportionate to the aim pursued and provides for suitable and specific safeguards. Section 10(2) of the DPA 2018 provides that the relevant basis in UK law is Part 1, paragraph 4 of Schedule 1 to the DPA 2018. Controllers must comply with the safeguards in Article 89(1) and section 19 of the DPA 2018, which include data minimisation, pseudonymisation where possible, and respect for data-subject rights. Schedule 1, paragraph 5 requires an APD.

The "necessary" test

Most of the conditions require processing to be "necessary" for a specified purpose. ICO guidance interprets "necessary" as more than merely useful or standard practice: processing must be a targeted and proportionate means of achieving the stated purpose. A condition will not apply if the purpose can reasonably be achieved by some other less intrusive means—in particular, by processing non-special-category data.

Inferred special-category data

ICO guidance clarifies that inferred data counts as special-category data if the controller's processing intends to make an inference linked to one of the special categories (such as ethnicity, beliefs, health status, or sexual orientation) or if the controller intends to treat someone differently on the basis of such inferred information. Under the ICO's interpretive position, Article 9 applies in these circumstances irrespective of the statistical confidence of the inference. Controllers must identify an Article 9 condition even when the special-category attribute is inferred rather than directly collected.

Appropriate policy document requirement

Schedule 1, paragraph 39 of the DPA 2018 requires controllers relying on certain Article 9 conditions—most of those under Article 9(2)(b), (g), (h), (i), or (j)—to maintain an appropriate policy document (APD). The APD must explain the controller's procedures for securing compliance with the Article 5 UK GDPR principles in connection with the processing of special-category data and set out the controller's policies for retaining and erasing such data. The ICO provides a template APD; the statutory minimum content is set out in Schedule 1, paragraph 39. The document must be retained for at least six months after the processing ceases and must be made available to the ICO on request.

Automated decision-making restrictions

Article 22(4) UK GDPR provides that solely automated decision-making (including profiling) that has legal or similarly significant effects may not be based on special-category data unless the processing is based on explicit consent under Article 9(2)(a) or is necessary for reasons of substantial public interest under Article 9(2)(g) and meets a Schedule 1 Part 2 condition, with suitable safeguards for the data subject's rights, freedoms, and legitimate interests in place.

Source: UK GDPR Article 9, legislation.gov.uk Source: Data Protection Act 2018, Schedule 1, legislation.gov.uk Source: ICO, Special category data — What are the rules on special category data? Source: ICO, Special category data — What are the conditions for processing?

Consent under Article 6(1)(a) UK GDPR is one of seven lawful bases for processing personal data. Article 4(11) UK GDPR defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

Consent is not inherently superior to the other lawful bases. The ICO emphasises that controllers must choose the lawful basis that best reflects the true nature of the relationship with the individual and the purpose of the processing. If consent is difficult to obtain, this is often because a different lawful basis (such as contract, legal obligation, or legitimate interests) is more appropriate.

The four statutory validity criteria

Valid consent must satisfy all four elements of the Article 4(11) definition:

1. Freely given

Consent must offer individuals genuine choice and control. Article 7(4) UK GDPR provides that when assessing whether consent is freely given, "utmost account shall be taken of whether… the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." Recital 43 UK GDPR adds that "consent is presumed not to be freely given… if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

The ICO interprets this strictly: if a controller makes consent a precondition of service and the processing is not objectively necessary for that service, consent is not freely given and is invalid. The ICO's guidance states that bundling consent with terms and conditions in this way is misleading and inherently unfair. In such cases, controllers should instead rely on Article 6(1)(b) (contract) if the processing is genuinely necessary for performance, or Article 6(1)(f) (legitimate interests) combined with transparent privacy information.

Recital 42 UK GDPR also requires that individuals must be able to refuse or withdraw consent without detriment. The ICO's view is that some incentivisation may be permissible—for example, offering money-off vouchers to customers who join a retailer's loyalty scheme and consent to marketing—but a clear penalty for refusal invalidates consent.

Recital 43 UK GDPR further warns that consent is unlikely to be freely given where there is a clear imbalance of power between controller and data subject, particularly for public authorities and employers. Public authorities performing public tasks and employers must take extra care to show that consent is freely given and should avoid over-reliance on this lawful basis.

2. Specific

Consent must cover a specific, identified purpose. If the processing has multiple purposes, consent must be obtained separately for each purpose (granular consent). Recital 32 UK GDPR states: "Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them." The ICO requires controllers to offer separate, distinct opt-in options for different purposes and types of processing.

Recital 42 UK GDPR requires that the individual must know the identity of the controller. This means the controller must identify itself by name, and also name any third-party controllers who will rely on the same consent. If a controller buys in "consented" data from a third party, that consent is only valid for the controller's own processing if it was specifically named at the time consent was obtained.

3. Informed

The individual must understand what they are consenting to. The request for consent must be in clear, plain language. Recital 32 UK GDPR provides that if the consent request is given by electronic means, "the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided." The ICO notes that this is not an exemption—avoiding disruption does not override the need for clarity and specificity, and some level of disruption may be necessary to obtain valid consent.

If the request is vague, sweeping, or uses language likely to confuse (such as double negatives or inconsistent terminology), consent is invalid.

4. Unambiguous

Consent requires a clear affirmative action. Recital 32 UK GDPR provides: "Consent should be given by a clear affirmative act… such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

The ICO interprets this as requiring a deliberate, positive opt-in. Acceptable methods include ticking an empty checkbox, signing a consent statement, oral confirmation, a binary choice presented with equal prominence, or actively switching technical settings. Pre-ticked boxes, inactivity, silence, and bundled acceptance within general terms and conditions are all invalid.

Verifiability requirement — Article 7(1)

Article 7(1) UK GDPR requires controllers to be able to demonstrate that a data subject has consented. Controllers must keep records of who consented, when, how, and what they were told at the time. The ICO's detailed guidance recommends that these records include the consent mechanism used, the consent wording presented, and the individual's consent response. Controllers should also keep consent under review and refresh it at appropriate intervals if the relationship, processing, or purposes change.

Right to withdraw consent — Article 7(3)

Article 7(3) UK GDPR provides: "The data subject shall have the right to withdraw his or her consent at any time." Withdrawal must be as easy as giving consent. Controllers must tell individuals about their right to withdraw and provide easy mechanisms to do so at any time. Once consent is withdrawn, the controller must stop the processing and, in most cases, delete the personal data gathered under that consent (subject to any other lawful basis or legal obligation to retain). Article 19 UK GDPR requires controllers to notify each recipient to whom the personal data has been disclosed of the withdrawal, unless this proves impossible or involves disproportionate effort.

Explicit consent under Article 9(2)(a)

Consent under Article 6(1)(a) is distinct from the explicit consent required for processing special-category data under Article 9(2)(a) UK GDPR. The ICO guidance states that explicit consent must be affirmed in a clear statement, whether oral or written. The Article 4(11) definition allows consent to be signified either by a statement (which counts as explicit) or by a clear affirmative action (which does not). Consent inferred from conduct, however obvious, cannot be explicit consent.

Consent and children — Article 8 UK GDPR

Article 8(1) UK GDPR (as modified by section 9 of the Data Protection Act 2018) sets the age of consent for information society services (ISS) at 13 years in the UK. If a controller offers an ISS directly to a child and relies on consent, processing of a child's personal data is lawful where the child is at least 13 years old. For children under 13, the controller must obtain consent from a person holding parental responsibility. Article 8(2) UK GDPR requires controllers to make reasonable efforts, taking into consideration available technology, to verify that any person giving consent on behalf of a child under 13 does in fact hold parental responsibility. The ICO states that a data protection impact assessment (DPIA) should help controllers decide what verification steps are reasonable in the event of a complaint.

Not always appropriate

The ICO guidance stresses that consent is not always the most appropriate lawful basis, even when processing personal data for purposes such as marketing, research, or profiling. Controllers should consider the five other Article 6 lawful bases (or, following the Data (Use and Access) Act 2025, the six other bases including the new recognised legitimate interests under Article 6(1)(ea)). Consent's strict requirements—particularly the right to withdraw at any time—make it unsuitable when the processing is genuinely necessary for the controller's operations or when the controller cannot easily cease processing on request. In those circumstances, another lawful basis is likely more appropriate.

Interaction with PECR cookie consent

The consent requirements for cookies and similar storage and access technologies are defined by the Privacy and Electronic Communications Regulations 2003 (PECR), not the UK GDPR. PECR requires that either the "user" or the "subscriber" must consent to the setting of non-exempt cookies on the user's device. However, the ICO confirms that for PECR consent to be valid, the person providing it must understand what they are consenting to; this means controllers must apply the UK GDPR's consent standards (freely given, specific, informed, unambiguous) when seeking cookie consent as well.

Source: UK GDPR Article 4(11), legislation.gov.uk Source: UK GDPR Article 6, legislation.gov.uk Source: UK GDPR Article 7, legislation.gov.uk Source: UK GDPR Recital 32, legislation.gov.uk Source: ICO, What is valid consent? Source: ICO, Consent

Article 6(1)(f) UK GDPR permits processing when it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." Legitimate interests is the most flexible of the seven lawful bases under Article 6, but it also places the greatest responsibility on the controller: the controller must identify a legitimate interest, demonstrate necessity, and affirmatively balance that interest against the data subject's rights and freedoms.

The three-part test

The three-part test is not explicitly set out in the UK GDPR, but the ICO interprets Article 6(1)(f) as requiring controllers to satisfy three sequential elements before processing begins. The test originates from the Court of Justice of the European Union's judgment in Rigas (C-13/16, 4 May 2017), which concerned legitimate interests in an earlier data protection directive; the CJEU's reasoning is retained case law for the UK post-Brexit.

1. Purpose test: identify the legitimate interest

The controller must identify a specific, real-world legitimate interest. This can be the controller's own interest (such as preventing fraud, ensuring network security, or growing the business), a third party's interest (including another individual or organisation), or the public's interest in the processing. The UK GDPR does not prescribe what qualifies as a "legitimate" interest; the ICO confirms that trivial, controversial, or commercial interests can all be legitimate. Article 6 UK GDPR, as amended by the Data (Use and Access) Act 2025, expressly identifies three examples of interests that may be legitimate: (a) direct marketing; (b) intra-group transmission of personal data for internal administrative purposes; and (c) ensuring the security of network and information systems. However, the ICO emphasises that these examples do not create a presumption; even when a purpose falls within one of the three examples, the controller must still complete the necessity and balancing tests and document the outcome in a Legitimate Interests Assessment (LIA).

2. Necessity test: is processing necessary for that purpose?

Processing is necessary only if it is a targeted and proportionate means of achieving the identified legitimate interest. The ICO interprets "necessary" as more than merely useful, convenient, or standard industry practice. If the controller can reasonably achieve the same purpose by processing less personal data, by processing non-personal data, or by using a less intrusive method, the necessity test is not met. Controllers should document what alternative measures they considered and why processing this personal data in this manner is the least intrusive option that will actually achieve the purpose.

3. Balancing test: do the data subject's interests, rights, or freedoms override the legitimate interest?

The controller must weigh the legitimate interest against the data subject's "interests or fundamental rights and freedoms." This is a light-touch risk assessment, not a full Data Protection Impact Assessment (DPIA), though if the LIA identifies potential high risks to data subjects' rights and freedoms, a DPIA is then required under Article 35 UK GDPR. The ICO guidance identifies key factors for the balancing test:

• Reasonable expectations. Would the data subject reasonably expect this processing in the context of the controller–data-subject relationship? If the processing would surprise or concern the data subject, the balance is likely to tip against the controller. Recital 47 UK GDPR states that a "relevant and appropriate relationship" between the data subject and the controller (for example, where the data subject is a customer or in the service of the controller) may support a finding that the processing is within reasonable expectations.

• Nature of the personal data. Processing special-category data (Article 9), criminal-offence data (Article 10), or children's data raises the bar significantly. Article 6(1)(f) itself states "in particular where the data subject is a child," signalling that children merit heightened protection. The ICO's position is that legitimate interests is rarely appropriate for special-category data or for profiling children, even if an Article 9 condition is also met.

• Impact on the data subject. What are the consequences of the processing for the individual? Is it intrusive, likely to cause harm or distress, or likely to limit the individual's control over their own data? Processing that causes substantial damage, distress, or unfair discrimination will typically fail the balancing test.

• Safeguards. What technical or organisational measures has the controller put in place to reduce the impact? Examples include pseudonymisation, access controls, transparency (clear privacy notices), and offering an easy opt-out mechanism. Strong safeguards can tip the balance in favour of the controller.

If, after weighing these factors, the data subject's interests, rights, or freedoms outweigh the controller's legitimate interest, Article 6(1)(f) does not apply. The ICO advises that if the outcome of the balancing test is uncertain or close, controllers should consider a different lawful basis (such as consent, if the controller is willing to give the data subject full control).

The Legitimate Interests Assessment (LIA) and documentation requirement

The ICO requires controllers to conduct and document a Legitimate Interests Assessment before they begin processing. There is no prescribed form for an LIA, but it must address all three parts of the test. The ICO publishes a sample LIA template. Controllers should record the outcome of each stage, including all relevant factors, whether those factors support or undermine the controller's conclusion. This demonstrates that the controller has considered the full picture before deciding to rely on legitimate interests, and it helps the controller meet the UK GDPR's accountability principle (Article 5(2)).

Controllers should refresh the LIA whenever anything significant changes—for example, if the purpose, the nature of the data, the context, or the relationship with the data subject changes. If a new, unforeseen impact arises, the controller should revisit the balancing test and consider whether additional safeguards are needed.

Restriction for public authorities performing public tasks

Article 6(1)(f) UK GDPR provides that legitimate interests "shall not apply to processing carried out by public authorities in the performance of their tasks." Section 7 of the Data Protection Act 2018 defines "public authority" to include bodies defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002, and bodies performing a task in the public interest or exercising official authority. When a public authority is performing a public task, it must rely on Article 6(1)(e) (public task) instead. Public authorities may rely on legitimate interests for processing unrelated to their public tasks—for example, managing their own employees or premises—but not for the core functions they were established to perform.

Right to object — Article 21 UK GDPR

Data subjects have the right to object to processing based on legitimate interests under Article 21(1) UK GDPR. The right to object is not absolute (except for direct marketing under Article 21(2)). When a data subject objects to processing based on Article 6(1)(f), the controller must stop processing unless it can demonstrate "compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject" or the processing is necessary for the establishment, exercise, or defence of legal claims. This is a higher bar than the balancing test conducted in the LIA: the controller must show that its grounds are compelling, not merely that they tip the balance. The ICO advises that controllers cannot simply repeat the LIA balancing test; they must take into account the individual's specific reasons for objecting.

For direct marketing, the right to object is absolute under Article 21(3). If a data subject objects to processing for direct marketing purposes, the controller must stop that processing immediately, and no compelling legitimate grounds can override the objection. This applies regardless of the lawful basis (even if the controller initially relied on Article 6(1)(f) or the new Article 6(1)(ea) recognised legitimate interests for direct marketing).

Relationship to the new Article 6(1)(ea) recognised legitimate interests

The Data (Use and Access) Act 2025 (Royal Assent June 2025) inserted a new Article 6(1)(ea) into the UK GDPR: processing is lawful if it is "necessary for the purposes of a recognised legitimate interest." The recognised legitimate interests are set out in new Annex 1 to the UK GDPR and include crime prevention, safeguarding vulnerable individuals, responding to emergencies, safeguarding national security, and assisting public authorities in delivering public-interest tasks. Processing under Article 6(1)(ea) must still be necessary, but it does not require the controller to complete a balancing test in advance. The new basis is available only to non-public-sector controllers; public authorities performing their public tasks cannot rely on Article 6(1)(ea) (mirroring the restriction for Article 6(1)(f)). Where a controller's purpose falls within one of the Annex 1 recognised legitimate interests, the controller may choose between Article 6(1)(f) (with a full LIA) and Article 6(1)(ea) (necessity only, no balancing test). The ICO has not yet published detailed guidance on when each basis is more appropriate, but the statutory design suggests that Article 6(1)(ea) is intended for high-societal-value processing where the legislature has already determined that the public interest in processing outweighs typical data-subject objections.

Interaction with data-subject rights

The choice of lawful basis affects which data-subject rights are available. When processing is based on legitimate interests (Article 6(1)(f) or (ea)), data subjects retain most rights under Chapter III UK GDPR, including the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), and objection (Article 21). However, the right to data portability (Article 20) does not apply to processing based on legitimate interests; it applies only when processing is based on consent (Article 6(1)(a)) or contract (Article 6(1)(b)) and is carried out by automated means.

Transparency requirement

Article 13(1)(d) UK GDPR requires that when a controller collects personal data from the data subject, the controller must inform the data subject of "the legitimate interests pursued by the controller or by a third party" if processing is based on Article 6(1)(f). This is in addition to the standard privacy-notice contents. The controller must clearly explain what the legitimate interest is—vague or generic statements ("to improve our services" or "for business purposes") do not meet the transparency standard. Controllers should explain the specific interest and, where relevant, refer the data subject to the LIA or to a summary of the balancing outcome.

Source: UK GDPR Article 6, legislation.gov.uk Source: Data Protection Act 2018 section 7, legislation.gov.uk Source: ICO, What is the 'legitimate interests' basis? Source: ICO, How do we apply legitimate interests in practice? Source: ICO, When can we rely on legitimate interests?

Article 6(1)(b) UK GDPR permits processing when it is "necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract." This lawful basis is essential for e-commerce, SaaS subscriptions, employment relationships, and any service delivery governed by contract. The ICO interprets the necessity requirement strictly: processing must be integral to delivering the contractual service to that specific individual, not merely useful to the controller's wider business model.

Recital 44 UK GDPR provides interpretive context: "Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract." The recital was retained in UK domestic law under section 3 of the European Union (Withdrawal) Act 2018 and continues to inform the interpretation of Article 6(1)(b).

Two limbs of Article 6(1)(b)

Article 6(1)(b) covers two distinct scenarios:

1. Processing necessary to perform an existing contract with the data subject

This applies when the controller has a binding contract with the individual and processing personal data is required to fulfil the controller's obligations or to enable the data subject to comply with their counter-obligations. Common examples include processing a customer's delivery address to ship goods purchased under a sales contract, processing payment details to execute a transaction, processing an employee's bank details to pay wages under an employment contract, and processing account credentials to provide access to a subscription service. The ICO emphasises that the processing must be objectively necessary for contract performance—that is, the controller could not reasonably deliver the contractual service without it.

2. Processing necessary to take pre-contractual steps at the request of the data subject

This applies before a contract is formed, when the individual has asked the controller to do something as a preliminary to entering into a contract. Examples include processing personal information to provide a quote for insurance or financial services, to verify eligibility for a service the individual wishes to purchase, or to set up an account before the first transaction. The individual must have initiated or requested the steps; the controller cannot unilaterally declare that processing is pre-contractual if the individual has not asked for it.

The "necessary" test — strictly construed

Article 6(1)(b) turns on whether processing is "necessary." The ICO's guidance interprets this term strictly. Necessity does not mean "absolutely the only way" to perform the contract, but it must be more than merely useful, convenient, or standard industry practice. Processing is necessary only if it is a targeted and proportionate step that is integral to delivering the contractual service or taking the requested pre-contractual action. The ICO states that this lawful basis does not apply if there are other reasonable and less intrusive ways to deliver the contractual service, or if the purpose can be achieved by processing less data or using non-personal data.

Crucially, the processing must be necessary to perform the contract with this particular person. If the processing is instead necessary to maintain the controller's wider business model, to improve service quality generally, or is included in the terms and conditions for purposes beyond delivering the specific service the individual contracted for, Article 6(1)(b) does not apply. In those cases, the controller should rely on another lawful basis, most commonly legitimate interests under Article 6(1)(f).

Impermissible bundling of non-contractual processing

The ICO warns against the common misapplication of relying on "contract" for processing that is not genuinely necessary for contract performance but is simply bundled into the controller's standard terms and conditions. Article 7(4) UK GDPR provides that when assessing whether consent is freely given, "utmost account shall be taken of whether… the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." Recital 43 UK GDPR extends this principle, stating that "consent is presumed not to be freely given… if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

The ICO interprets these provisions as precluding controllers from making service conditional on processing that is not objectively necessary for that service. For example, a music-streaming service cannot rely on Article 6(1)(b) for personalised advertising or behavioural profiling, even if those features are described in the terms of service, because the core contractual service (streaming music) can be delivered without them. Such processing requires a different lawful basis—typically legitimate interests (with a full balancing test documented in a Legitimate Interests Assessment) or, if the controller wishes to give individuals full control, consent.

The EDPB (European Data Protection Board) adopted final guidelines on processing under Article 6(1)(b) in the context of online services in October 2019. These guidelines are not binding on the UK regime post-Brexit, but the ICO's interpretive position aligns closely with the EDPB's strict reading: the contract basis is not available for ancillary or value-added processing that is separate from the core service, even if that processing is commercially valuable to the controller.

Contracts with children under 18

If the contract is with a child under 18, controllers must consider whether the child has the necessary legal competence to enter into the contract under UK law. The common-law position is that contracts with minors are voidable at the minor's option unless they are for "necessaries" (goods or services suitable to the child's condition in life and to their actual requirements at the time). If the controller has doubts about the child's contractual capacity, the contract may be void or voidable, and in that case the processing cannot be justified under Article 6(1)(b). The ICO advises that controllers may wish to consider an alternative lawful basis, such as legitimate interests, which requires a balancing test that explicitly accounts for the child's rights and interests. Article 6(1)(f) itself states "in particular where the data subject is a child," signalling heightened protection for children under the legitimate-interests basis.

No consent required if processing is necessary for the contract

If processing is genuinely necessary for the contract under Article 6(1)(b), the controller does not need to obtain separate consent. Indeed, the ICO cautions that asking for consent in this scenario is misleading and risks "consent fatigue," because the individual has no real choice—they cannot receive the service without the processing. Bundling unnecessary processing with a purported consent request within terms and conditions is also problematic: if the processing is genuinely necessary, the lawful basis is contract, not consent; if it is not necessary, then conditioning the service on it renders any "consent" invalid as not freely given.

If the controller is processing special-category data (Article 9 UK GDPR) and that processing is necessary for the contract, the controller must also identify a separate Article 9(2) condition. Article 6(1)(b) is the lawful basis, but it does not satisfy the additional layer of protection required for special-category data. The ICO's guidance on special category data notes that most of the Article 9 conditions are narrowly drawn, and relying on Article 6(1)(b) plus an Article 9 condition for contract performance is less common than relying on explicit consent (Article 9(2)(a)) or one of the substantial-public-interest conditions (Article 9(2)(g) plus a Part 2 Schedule 1 condition under the Data Protection Act 2018).

Impact on data-subject rights

The choice of Article 6(1)(b) affects which data-subject rights apply. Individuals processed under the contract lawful basis have no right to object under Article 21 UK GDPR (the right to object applies only to processing based on public task or legitimate interests) and no right to erasure under Article 17 if the processing remains necessary for contract performance. However, individuals do have a right to data portability under Article 20 UK GDPR when processing is based on contract (or consent) and is carried out by automated means. The controller must provide the personal data the individual provided in a structured, commonly used, machine-readable format, and the individual has the right to transmit that data to another controller. Recital 68 UK GDPR (retained in UK law) clarifies that the right to data portability "should not prejudice the right of the data subject to obtain the erasure of personal data… and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract."

Transparency requirement

Controllers relying on Article 6(1)(b) must include information about the lawful basis in the privacy notice provided to data subjects under Articles 13 or 14 UK GDPR. The controller must explain the purposes of the processing and identify "contract" as the lawful basis. The ICO emphasises that vague statements such as "we process your data to provide our services" do not meet the transparency standard; the controller should specify which processing is necessary for which aspect of contract performance.

Documentation and accountability

The ICO requires controllers to document their decision that processing is necessary for the contract and to be able to justify that reasoning on request. This is an aspect of the accountability principle under Article 5(2) UK GDPR. Controllers should maintain a record of processing activities (ROPA) under Article 30 UK GDPR that identifies the lawful basis for each processing purpose, and should be prepared to explain why the processing could not reasonably be accomplished by less intrusive means or by processing less data.

Source: UK GDPR Article 6(1)(b), legislation.gov.uk Source: UK GDPR Recital 44, legislation.gov.uk Source: ICO, Contract

Article 6(1)(b) UK GDPR permits processing when it is "necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract." This lawful basis is commonly relied upon in commercial settings—SaaS, e-commerce, employment, banking—but its scope is narrower than many controllers assume. The ICO interprets the necessity requirement strictly: processing must be objectively integral to delivering the contractual service to the individual, not merely useful to the controller's business model or mentioned in the terms and conditions.

The two limbs of Article 6(1)(b)

The lawful basis covers two distinct scenarios:

1. Performance of an existing contract. Processing is necessary to fulfil the controller's obligations under a contract with the data subject, or to enable the data subject to comply with their counter-obligations (for example, processing payment details so the customer can pay).

1. Pre-contractual steps at the data subject's request. Processing is necessary to take steps that the data subject has asked the controller to take before entering into a contract—for example, processing personal data to provide a quote, an eligibility assessment, or a product recommendation that the individual has requested.

The second limb requires that the individual has requested the step. If the controller unilaterally decides to take a pre-contractual step (such as running a credit check the individual did not request), Article 6(1)(b) does not apply, and the controller must identify a different lawful basis.

The strict necessity test: integral, not merely useful

The ICO's guidance on contract explains that "necessary" means more than useful, convenient, or standard industry practice. Processing is necessary only if it is "a targeted and proportionate step which is integral to delivering the contractual service or taking the requested action." The lawful basis does not apply "if there are other reasonable and less intrusive ways to deliver the contractual service or take the steps requested."

The ICO emphasizes that "the processing must be necessary to perform the contract with this particular person. If the processing is instead necessary to maintain your business model more generally, or is included in your terms for other business purposes beyond delivering the contractual service, this lawful basis will not apply." In those circumstances, controllers should consider Article 6(1)(f) legitimate interests (with a balancing test) or Article 6(1)(a) consent.

The contractual-mention fallacy

Including a processing activity in the terms and conditions does not, by itself, make that processing "necessary for the performance of a contract." The ICO warns that processing must be "more than just useful, and more than just part of your standard terms." The test is whether the processing is objectively integral to the service the individual has requested, not whether the controller has unilaterally declared it to be a contractual requirement.

Recital 44 UK GDPR provides that "processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract." The ICO interprets this as requiring the processing to be intrinsic to the service, not merely associated with it.

Profiling, personalization, and targeted advertising: rarely necessary

The ICO's contract guidance includes a worked example: "the profiling of an individual's interests and preferences based on items purchased is not necessary for the performance of the contract and the controller cannot rely on Article 6(1)(b) as the lawful basis for this processing. Even if this type of targeted advertising is a useful part of your customer relationship and is a necessary part of your business model, it is not necessary to perform the contract itself."

The guidance confirms that "this does not mean that processing which is not necessary for the contract is automatically unlawful, but rather that you need to look for a different lawful basis (and other safeguards such as the right to object may come into play)."

The ICO's AI guidance applies the same logic to AI-driven personalization: processing personal data by an AI system to personalize content may be regarded as necessary for the performance of a contract "but only in some cases." Whether the processing is intrinsic depends on "whether you can provide your service without this processing (ie if the personalisation of content by means of an AI system is not integral to the service, you should consider an alternative lawful basis)."

Contracts with children

The ICO notes that if the contract is with a child under 18, "you need to consider whether they have the necessary competence to enter into a contract." If there are doubts about competence, "you may wish to consider an alternative basis such as legitimate interests, which can help you to demonstrate that the child's rights and interests are properly considered and protected."

Processing special-category data on the contract basis

If processing of special-category data (Article 9) is necessary for the contract, the controller must identify both an Article 6 lawful basis and a separate Article 9 condition. Article 6(1)(b) can serve as the Article 6 basis, but the controller must still meet one of the ten conditions under Article 9(2).

The ICO confirms that explicit consent under Article 9(2)(a) may be available as the Article 9 condition even if the processing is a condition of the service, provided "you must be confident that you can demonstrate that consent is still freely given. In particular, that the processing is objectively necessary to perform a requested element of the service, and not bundled together with other elements of the service or included in your terms for broader business purposes." The ICO's published example: a gym that introduces a facial recognition system and requires all members to agree to facial recognition as a condition of entry, with no alternative access method, is not obtaining valid consent, because "although facial recognition might have some security and convenience benefits, it is not objectively necessary in order to provide access to gym facilities."

No right to object (except for direct marketing)

When processing is based on Article 6(1)(b) contract, the data subject does not have the right to object under Article 21(1) UK GDPR, except for the absolute right to object to direct marketing under Article 21(2)/(3), which applies regardless of lawful basis. The ICO confirms that "if you are processing on the basis of contract, the individual's right to object and right not to be subject to a decision based solely on automated processing will not apply."

The right to data portability under Article 20 UK GDPR does apply when processing is based on contract and the processing is carried out by automated means. Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Documentation and transparency requirements

The ICO requires controllers to "document your decision to rely on this lawful basis and ensure that you can justify your reasoning." Controllers should record what processing is being carried out, why it is necessary for the contract with the individual, and what alternative, less intrusive methods were considered.

Controllers relying on Article 6(1)(b) must include information about the lawful basis in the privacy notice provided to data subjects at the point of data collection (Articles 13 and 14 UK GDPR). Generic statements that processing is "to provide our services" or "to perform the contract" are insufficient; the controller must clearly explain what specific processing is necessary for what specific contractual purpose.

Interaction with EDPB Guidelines 2/2019

The European Data Protection Board (EDPB) published Guidelines 2/2019 on processing under Article 6(1)(b) in the context of online services (adopted 8 October 2019), interpreting the contract lawful basis narrowly for behavioral advertising and personalized content delivery. The ICO notes that "EDPB guidelines are no longer be directly relevant to the UK regime and are not binding under the UK regime." However, the ICO's own guidance on Article 6(1)(b) reflects a similar interpretive position: that the contract basis applies only to processing that is objectively integral to the service requested by the individual.

Source: UK GDPR Article 6, legislation.gov.uk Source: UK GDPR Recital 44, legislation.gov.uk Source: ICO, Contract (lawful basis guidance) Source: ICO, When is consent appropriate? Source: ICO, How do we ensure lawfulness in AI?

Article 10 UK GDPR continues to impose a distinct layer of protection for personal data relating to criminal convictions, offences, or related security measures. Since the last update to this section, a material legislative change has occurred: the Data (Use and Access) Act 2026 has now fully received Royal Assent (19 June 2025) and commenced, with all relevant data protection and PECR amendments in force as of February 2026. This new legislation does not fundamentally alter the two-layer requirement under Article 10 for criminal-offence data, but it has reinforced the domestic legislative framework and addressed harmonisation with relevant international law.

Scope — what is criminal-offence data?

Article 10 UK GDPR applies to "personal data relating to criminal convictions and offences or related security measures." Section 11(2) of the Data Protection Act 2018 expands this to include alleged offences and proceedings. The ICO confirms the definition covers not only convictions and criminal trials, but also allegations and ongoing investigations. Data in a criminal record check (such as a DBS check) counts as criminal-offence data, even if "clear" of offences, because it relates to the individual's criminal history.

Dual-layer requirement — Article 6 lawful basis plus Article 10 condition

Controllers must identify both:

• an Article 6 lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests, or from February 2026, recognised legitimate interests under Article 6(1)(ea)), and
• a lawful mechanism under Article 10—either processing under official authority or a relevant condition from Schedule 1 of the DPA 2018.

The Data (Use and Access) Act 2026 (as commenced by SI 2026/82) consolidated prior amendments but retained this dual structure.

Official authority vs. Schedule 1 condition

Processing by a public authority, or a body with legal power to process such data, may rely on its official authority. In all other cases, a controller must identify a specific Schedule 1 condition from the DPA 2018. These conditions (Parts 1, 2, or 3 of Schedule 1) include employment/social protection, substantial public interest, consent (with strict requirements), legal claims, and others. The Data (Use and Access) Act amendments included clarification powers for the Secretary of State to update the list of recognised legitimate interests, but did not alter the basic structure for criminal-offence data.

Appropriate policy documents and registers

Controllers relying on most Schedule 1 conditions must maintain an appropriate policy document, as described in Schedule 1, para 5 and para 39. Comprehensive criminal conviction registers remain lawful only under the control of official authority (Article 10(1) UK GDPR).

Interaction with Part 3 of DPA 2018

Article 10 applies when the processing falls under Part 2 of DPA 2018 (general processing). Law enforcement processing by competent authorities is governed instead by Part 3 DPA 2018 (not Article 10).

No additional exemptions introduced

The 2026 Act did not introduce new exemptions from Article 10, apart from technical harmonisation. The only exemption from Article 10 remains the public interest exemption for journalism or similar activities (DPA 2018, Sch 2, Pt 5, para 26).

Source: UK GDPR Article 10, as amended, legislation.gov.uk Source: Data Protection Act 2018, section 10, legislation.gov.uk Source: Data Protection Act 2018, section 11, legislation.gov.uk Source: Data Protection Act 2018, Schedule 1, as amended, legislation.gov.uk Source: Data (Use and Access) Act 2025, Royal Assent and commencement Source: SI 2026/82, Data (Use and Access) Act 2025 (Commencement No. 2) Regulations 2026 Source: ICO, What are the rules on criminal offence data?

Article 6(1)(c) UK GDPR allows personal data processing if it is “necessary for compliance with a legal obligation to which the controller is subject.” This basis is construed narrowly: the obligation must arise from UK law—typically a statute, statutory instrument, or, in some cases, a clear and well-accepted legal duty at common law—not from private contract or organisational policy. The ICO guidance confirms that after Brexit, “law” for this purpose means the law of the United Kingdom or a part of it.

Under Article 6(3) UK GDPR, the source of the legal obligation must be “laid down by law.” This includes Acts of Parliament, statutory instruments, or, where sufficiently certain, obligations imposed by existing case law. Regulatory duties with a statutory foundation—such as some Financial Conduct Authority (FCA) requirements—can also qualify. However, ambiguous duties or internal compliance requirements do not meet this threshold.

The ICO provides several statutory illustrations of valid reliance on this basis, such as:

• Keeping employee pay and tax records to comply with HMRC requirements (PAYE regulations)
• Carrying out right-to-work checks (Immigration, Asylum and Nationality Act 2006)
• Health and safety recordkeeping (Health and Safety at Work Act 1974)
• Compliance with anti-money laundering obligations (Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017)

These are representative and not exhaustive; other obligations may apply where law, statute, or regulation mandates processing. Additional examples not listed by the ICO, but generally recognised, include data retention duties for statutory child safeguarding or under sector-specific reporting laws.

Critically, processing must be objectively necessary to discharge the specific legal duty; extra or merely useful data collection is not covered. Where a less intrusive means is available for compliance, or where the duty is unclear, this lawful basis may not be appropriate.

Controllers must document their decision to rely on Article 6(1)(c) and should identify the particular law imposing the obligation. This supports the accountability principle under Article 5(2) UK GDPR. Privacy notices must identify the relevant legal obligation per Article 13(1)(c), and the ICO cautions that merely stating "to comply with our legal obligations" is insufficient—privacy notices should name the particular law or regulation where feasible.

Data-subject rights are restricted under this basis: individuals do not have the right to erasure or to object to processing of data the controller is required to keep for legal compliance, as confirmed by the ICO. Once the legal obligation lapses, controllers must reassess retention and delete personal data unless another lawful basis applies.

Source: UK GDPR Article 6(1)(c), legislation.gov.uk Source: ICO, What is the 'legal obligation' basis?

Section 7 of the Data Protection Act 2018 (DPA 2018) gives statutory meaning to "public authority" for UK data protection law. A public authority is defined here as any organisation listed in Schedule 1 of the Freedom of Information Act 2000 (FOIA), or, in Scotland, Schedule 1 of the Freedom of Information (Scotland) Act 2002. This includes central and local government, NHS bodies, state schools, police authorities, and other entities with functions specified in those Schedules. However, a body is treated as a public authority only for the tasks, functions, or powers it performs as a public authority—when acting in a public capacity. When performing non-public or commercial functions, the same organisation is not regarded as a public authority for those activities (DPA 2018, s.7(3)).

This statutory definition directly affects the choice of lawful basis under Article 6 UK GDPR:

• Only a public authority, as defined above, can rely on the Article 6(1)(e) "public task" basis for personal data processing done as part of its official functions or in exercise of official authority vested by law. The underlying function must have a foundation in UK law (statute, secondary legislation, or clear common-law duty). The ICO confirms this interpretation and provides illustrative examples such as maintaining the electoral register or conducting statutory health protection work.
• Public authorities, when acting in this official capacity, cannot rely on legitimate interests (Article 6(1)(f)) for that processing. This limitation is explicit in Article 6(1)(f). However, if the same authority acts in a private or non-public role (e.g., managing staff payroll, running a staff canteen), it may use other bases, including legitimate interests, subject to the usual requirements. The ICO notes that controllers should identify the capacity in which they are acting for each processing operation.
• The scope of "public task" is further elaborated in Section 8 DPA 2018, which clarifies that it covers activities such as administration of justice, exercise of official authority, and performance of functions conferred by legislation or rule of law.

The ICO stresses that public authorities must document:

• how they meet the definition under Section 7 (reference to FOIA Schedule 1),
• which legal function supports reliance on the public task basis,
• and which processing operations relate to public versus non-public functions.

Where public or private organisations are unsure about their classification, or about the statutory authority grounding a task, the ICO recommends seeking clarity against FOIA and DPA 2018 schedules and not assuming public authority status unless clearly established.

Source: Data Protection Act 2018, Section 7, legislation.gov.uk Source: ICO, Lawful basis: public task

Article 6(1)(d) UK GDPR permits processing personal data when it is “necessary in order to protect the vital interests of the data subject or another natural person.” The ICO interprets this basis strictly: it applies only in cases of life-or-death urgency, typically where the individual cannot give consent. Examples include emergency medical care for someone who is unconscious, or processing required to safeguard a child or vulnerable adult in immediate danger.

Narrow scope: life and death matters only

The ICO confirms that the vital interests basis is designed for exceptional circumstances. Processing on this ground is not justified where less intrusive or less urgent lawful bases are available. For example, if the data subject can consent but refuses—even in a medical context—Article 6(1)(d) does not apply. The standard is necessity: processing must be objectively required to protect someone’s life, not merely helpful or prudent. Everyday business, health, or welfare interests are outside scope. The ICO guidance further explains that most public-health or safeguarding processing should be based on legal obligation or public task, not vital interests.

Interaction with special-category and children’s data

Where the processing concerns special-category data (Art. 9), the higher threshold of Article 9(2)(c) applies: the processing must be “necessary to protect the vital interests of the data subject or another natural person, where the data subject is physically or legally incapable of giving consent.” For children, this includes situations where a child is at immediate risk and cannot consent due to age or incapacity.

Burden of proof and documentation

Controllers must be able to show that (1) no other lawful basis fits, (2) the situation is genuinely urgent, (3) processing is indispensable to prevent harm or save a life, and (4) the affected person is incapable of consenting at the moment of processing. The ICO recommends documenting the justification as soon as practicable, even if immediate action is required. This supports accountability (Art. 5(2) UK GDPR).

Typical scenarios

• Emergency medical treatment where the patient is unconscious and consent cannot be obtained.
• Contacting next of kin in a disaster or accident scenario.
• Safeguarding a vulnerable adult or child in circumstances of acute threat (e.g., evidence of abuse and the individual cannot consent).

The vital interests ground should not be relied on for routine health or safeguarding tasks: whenever other lawful bases are available (such as consent, contract, legal obligation, or public task), those prevail.

Source: UK GDPR Article 6(1)(d), legislation.gov.uk Source: ICO, What is the ‘vital interests’ basis?

As of March 2026, the obligation to communicate and document your lawful basis for processing personal data under UK GDPR Articles 13, 14, 5(2), and 30 is materially affected by new ICO guidance on legitimate interests and the phased commencement of the Data (Use and Access) Act 2025 (DUAA). Practitioners must now account for both interpretive changes from the ICO and emerging statutory amendments, especially relating to the new “recognised legitimate interest” basis.

Key requirement — Updated privacy notices (Articles 13–14 UK GDPR, ICO 2026 guidance) ICO’s March 2026 guidance update clarifies that where legitimate interests is relied on (Article 6(1)(f)), privacy notices must (a) specify the legitimate interest in plain language, (b) demonstrate proportionality in using this basis versus alternatives, and (c) disclose any reliance on the new “recognised legitimate interest” basis (Article 6(1)(ea), as introduced by DUAA), once formal guidance is available. Vague or generic statements (e.g., “we process your data for legitimate interests”) are no longer compliant—each purpose and associated lawful basis must be named, and privacy information must be reviewed and redrafted to align with ICO’s preferred layering and clarity standards. The controller must specify whether the basis is regular “legitimate interests” or “recognised legitimate interest,” and cite the relevant statutory ground in Annex 1 for the latter, per draft DUAA guidance.

Records of Processing Activities (ROPA) and Accountability (Articles 5(2), 30 UK GDPR) Controllers’ ROPA entries must explicitly specify the lawful basis for each processing operation. Under both new ICO guidance and DUAA amendments, this includes distinguishing whether Article 6(1)(f) or Article 6(1)(ea) is relied upon, referencing the relevant interest or Annex 1 ground for recognised legitimate interests. Documentation should be version-controlled, and accountability records should reflect both compliance with up-to-date guidance and the statutory introduction/effective date of DUAA reforms.

DUAA: Statutory expansion and phase-in The Data (Use and Access) Act 2025 introduces Article 6(1)(ea) as a new lawful basis for “recognised legitimate interest.” This basis applies for pre-approved public-interest purposes (Annex 1), eliminating the individual balancing test required under Article 6(1)(f). As of March 2026, ICO formal guidance on use of Article 6(1)(ea) is pending. Controllers must audit their data processing purposes and, if planning to rely on the new basis, prepare to revise privacy notices and ROPA documentation once guidance is live. Until then, controllers should continue to apply enhanced specificity and transparency for any legitimate interests disclosed.

Key dates and best practices

• Effective from March 2026 for legitimate interests notice/documentation guidance.
• DUAA 2025 commencement for recognised legitimate interest as a lawful basis: phased from 5 February 2026.
• Controllers should audit all lawful bases, update privacy notices for specificity, and amend ROPA to distinguish between Article 6(1)(f) and new Article 6(1)(ea) operations as regulations and ICO guidance evolve.

Source: UK GDPR Article 13, legislation.gov.uk Source: UK GDPR Article 14, legislation.gov.uk Source: UK GDPR Article 5(2), legislation.gov.uk Source: UK GDPR Article 30, legislation.gov.uk Source: Data (Use and Access) Act 2025, Part 5, section 70, legislation.gov.uk Source: SI 2026/82 Commencement Regulations, legislation.gov.uk Source: ICO, Lawful basis and privacy information — post-DUAA guidance March 2026

Children’s consent and the age threshold for information society services (ISS)

Article 8 UK GDPR establishes a special regime when information society services (ISS)—mainly online services provided at a distance, by electronic means, at the individual’s request—are offered directly to a child. Under Article 8(1), where consent is relied upon as the lawful basis for processing a child’s data, consent is only valid if the child is at least the age set by national law (not exceeding 16). The UK exercised its discretion (Section 9 DPA 2018) to lower this age to 13.

Accordingly, in the UK, if an ISS controller relies on consent as the lawful basis for processing a child’s personal data, it must obtain valid consent from the child if they are 13 or over. For children under 13, consent must instead be given by someone with parental responsibility. This applies only where consent is the lawful basis (Article 6(1)(a)), not where another basis (contract, legitimate interests, etc.) is used.

Scope: what qualifies as an ‘information society service’?

ISS encompasses most commercial websites, apps, SaaS, social networks, games, and online communities, whether or not payment is required. Exceptions include services acting in an official public capacity (e.g., public education portals).

Verification requirement and controller obligations

Article 8(2) UK GDPR requires controllers make “reasonable efforts,” taking account of available technology, to verify that parental consent has been provided for under-13s. There is no prescribed method; the ICO confirms this is context-dependent, but retaining records and using mechanisms like email checks, credit card verification, or technical solutions may be reasonable depending on risk and the nature of the ISS. The ICO’s guidance and Age Appropriate Design Code (Children’s Code) elaborate on proportionality, fairness, and the practical limits of age-checking.

Best practices and documentation

Controllers must document how age is assessed, how parental consent is obtained for under-13s, and how records are retained. The age of digital consent should be communicated in privacy notices and relevant terms. If the controller cannot verify age or obtain parental consent, processing based on consent is unlawful. Controllers that intentionally or negligently fail to comply risk regulatory enforcement under both UK GDPR and DPA 2018.

Relationship to other lawful bases and international context

The UK’s age threshold is notably lower than in the EU (where the default is 16 unless a Member State sets it lower, but not below 13). Controllers operating cross-border should assess the applicable age in each country. Where another lawful basis applies (e.g., contract), Article 8 does not trigger, but general UK contract law on capacity may apply.

Summary

• Consent for ISS is valid from age 13 in the UK; for under 13, parental consent is required.
• Applies to online/direct-to-consumer services relying on consent as the lawful basis.
• Controllers must make reasonable efforts to verify age/parental responsibility and keep records.

Source: UK GDPR Article 8, legislation.gov.uk Source: Data Protection Act 2018, Section 9, legislation.gov.uk Source: ICO, Children’s Code — Age Appropriate Design Code

Article 6(1)(f) UK GDPR prohibits public authorities from relying on the 'legitimate interests' lawful basis for any personal data processing they perform in the exercise of their official public authority functions. Instead, such processing must use the 'public task' basis in Article 6(1)(e), which applies when processing is "necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller." The ICO and Section 7 of the Data Protection Act 2018 (DPA 2018) define 'public authority' as any entity listed in Schedule 1 to the Freedom of Information Act 2000 (FOIA), or for Scotland, the schedule to the Freedom of Information (Scotland) Act 2002.

How does this apply to controllers with both public and private functions?

This prohibition is not absolute. It applies only when the organisation is acting as a public authority for the task at hand—not in its private or commercial capacities. Section 7(3) DPA 2018 specifies that where a body is only a public authority for certain purposes, it is considered a public authority only for those activities—not for its private, non-statutory, or commercial roles. For example, a local council may run both statutory services (waste collection) and a commercial leisure facility; the former processing must use 'public task,' but the latter can, if appropriate, rely on 'legitimate interests.' The controller must clearly distinguish between such purposes in its records and privacy notices.

Compliance challenge: Documentation and decision-making

The ICO requires public authorities and bodies with mixed functions to: (1) document which activities are performed as public authority and why, (2) tie each processing purpose to the correct lawful basis, and (3) explain this choice in the Records of Processing Activities (ROPA) and privacy notices. Where the function is ambiguous or 'hybrid' (such as foundation schools or NHS Trust subsidiaries), the controller has the burden to justify why it is relying on a non-public-law basis. Importantly, if the function is genuinely public—conferred by statute or law—then 'public task' is mandatory, and legitimate interests cannot be used.

If a public authority relies on legitimate interests for a task that is actually public, it is unlawfully processing without a lawful basis. This exposure to ICO enforcement can trigger demands for rectification or erasure and, where systemic, administrative fines under Article 83 UK GDPR.

Practical steps and best practices

• Map every processing purpose to a public or non-public/commercial function
• Document the rationale and legal foundation for each classification
• Use precise language in privacy notices, clarifying when data is used in a public or private role
• Review organisational roles and processing regularly as duties or structures evolve
• If uncertain, classify as public authority for the function and use Article 6(1)(e)

Failure to follow these steps, as set out by the ICO and in DPA s.7, risks unlawful processing, loss of a valid lawful basis, and regulatory enforcement.

Source: Data Protection Act 2018, Section 7 Source: ICO, Lawful basis — public task and legitimate interests Source: ICO, Lawful basis — guide, mixed purposes

The Data (Use and Access) Act 2025 inserted a new lawful basis for processing personal data into the UK GDPR: Article 6(1)(ea), “processing is necessary for the purposes of a recognised legitimate interest.” This new basis takes effect from 20 August 2025 and is designed to streamline compliance where Parliament has determined, on the face of the law, that certain high-societal-value purposes justify the use of personal data without the full balancing test required for ordinary “legitimate interests” under Article 6(1)(f).

Statutory Text and Coverage Section 70 of the Data (Use and Access) Act 2025 amends Article 6 UK GDPR by introducing paragraph (1)(ea), under which processing is lawful if “necessary for the purposes of a recognised legitimate interest.” These recognised interests are defined in a new Annex 1 to the UK GDPR. At commencement, Annex 1 includes:

• Prevention and detection of crime
• Safeguarding of children and vulnerable adults
• Responding to emergencies
• National security
• Disclosure to public authorities acting in the public interest

The Secretary of State may amend Annex 1 by regulations using the affirmative resolution procedure (section 70(6)-(7) of the Act).

Key features of Article 6(1)(ea):

• No balancing test: For recognised legitimate interests, the controller does not need to conduct the Article 6(1)(f) balancing test. The necessity and proportionality have already been determined by Parliament for these listed purposes.
• Non-public authority limitation: Article 6(1)(ea)—like 6(1)(f)—is not available to public authorities acting in the performance of their public functions (see amended Article 6(1)(ea)(ii) and Data Protection Act 2018 s.7).
• Other obligations still apply: The new basis does not remove requirements for special-category data (Article 9), criminal-offence data (Article 10), or for transparency and record-keeping under Articles 13, 14 and 30. Controllers must still document their reliance on Article 6(1)(ea) and specify the recognised legitimate interest in privacy notices and records.

Interaction with existing lawful bases: Controllers may still rely on other lawful bases (such as contract, legal obligation, or the original legitimate interests test in Article 6(1)(f)), but must not use Article 6(1)(ea) for processing that does not match an Annex 1 purpose, nor should they duplicate justification for the same processing under multiple categories without good reason.

Practical example: A private company processing personal data solely to assist law enforcement agencies in the investigation of a crime may rely on Article 6(1)(ea), provided the purpose falls within Annex 1 and no public-authority role is performed. The controller must record and declare the recognised legitimate interest relied on.

As with all bases, the controller must justify necessity—whether the processing is genuinely required for the recognised purpose and if a less intrusive method could be employed.

Source: Data (Use and Access) Act 2025, section 70 (full text), legislation.gov.uk Source: UK GDPR, Article 6(1)(ea) as amended 2025, legislation.gov.uk Source: UK GDPR, Annex 1 (as inserted by DUAA 2025), legislation.gov.uk

The UK GDPR requires controllers to select and communicate a lawful basis for processing personal data before any processing begins (Articles 6(1) and 13(1)(c)). The Information Commissioner's Office (ICO) underscores in its guidance: “You must determine your lawful basis before you start processing, and you should not generally change your lawful basis at a later date.”

Statutory foundation and ICO practical detail

• Article 6(1) UK GDPR mandates that processing is lawful only if at least one lawful basis applies. Article 13(1)(c) requires the lawful basis be specified in the privacy information provided to the data subject at collection.
• Article 6(4) UK GDPR sets out the compatibility test if a controller wishes to process data for a new purpose not originally communicated: it must consider (a) any link between the original and new purpose, (b) context of collection, (c) the nature of the data, (d) possible consequences for individuals, and (e) whether appropriate safeguards exist.

ICO position on switching lawful basis

The ICO states that switching from one lawful basis to another during the lifecycle of processing is not generally allowed, as it can undermine transparency and individuals’ expectations. However, ICO guidance allows for rare exceptions, such as:

• A new legal obligation arises after data was collected (e.g., due to a new statutory requirement or a court order compelling disclosure).
• The relationship between controller and data subject has fundamentally changed (e.g., a contract has ended and a controller retains data under a legal obligation).

These situations are practical examples drawn from the ICO, not enumerated directly in the statute.

If a basis switch is contemplated, controllers must:

1. Assess whether the new processing purpose is compatible with the original purpose by applying Article 6(4)’s compatibility criteria.
2. Update privacy notices (per Articles 13/14) proactively before relying on the new legal basis for new or further processing.
3. Keep detailed records of the assessment, justification for change, and steps taken, in line with Article 5(2) accountability and Article 30 (ROPA) requirements.

Strict prohibitions and warnings

• It is unlawful to attempt to retroactively justify previous processing with a new basis (“backfilling” lawful basis).
• When consent is withdrawn, further processing may only continue if a new, clearly lawful, and compatible basis applies and the individual is fully informed in advance.
• Failure to meet these transparency, notification, and compatibility requirements could breach Articles 5(1)(a), 6(1), and 13/14 UK GDPR and expose the controller to enforcement.

While the ICO alludes to enforcement consequences for non-compliance, it does not cite published cases of direct penalties solely for post-hoc basis switching.

Source: UK GDPR Article 6, legislation.gov.uk Source: UK GDPR Article 13, legislation.gov.uk Source: ICO, Lawful basis for processing: What is the lawful basis for processing?