Fixing an Unclear or Missing Lawful Basis
Every use of personal data needs a lawful basis: one of six reasons set out in Article 6 of the UK GDPR. Many small-business websites either never chose one, say "we rely on consent" for everything, or list a basis in the privacy policy that does not match what the site really does.
The GDPR Audit flags when your privacy information does not make the basis clear. This guide shows how to list your purposes, match each to the right basis, test consent and legitimate interests properly, handle sensitive data, and write the result down where it counts.
Before you start: this is not legal advice
This guide explains how the lawful bases work and how to apply them to typical website activities. It is not legal advice. If you process health data, data about children, criminal records, or anything where the stakes for people are high, or you are a public authority, take advice from a solicitor or data protection specialist. The ICO's guidance on lawful basis, including its interactive tool, is free and worth reading alongside this page.
The Data (Use and Access) Act 2025 adds a new basis called recognised legitimate interests and clarifies some others. Its provisions are being brought into force in stages, so check the ICO's current guidance before relying on the changes described below.
The six lawful bases
No basis is better than another. The right one depends on your purpose and your relationship with the person. You need exactly one for each purpose, decided before you start, and you should not swap it later because another looks more convenient.
| Basis | Article 6(1) | Use it when | Watch out for |
|---|---|---|---|
| Consent | (a) | You want to offer people a real choice and control, such as optional marketing or non-essential cookies. | Must be freely given, specific, informed, unambiguous and as easy to withdraw as to give. Hard to use where there is an imbalance of power, such as with employees. |
| Contract | (b) | Processing is necessary to deliver something the person asked for, or to take steps they requested before a contract, such as a quote. | Only what is genuinely necessary. Marketing and analytics are not necessary to deliver an order. |
| Legal obligation | (c) | A law requires it, such as keeping invoices for tax. | You should be able to point to the law in question. |
| Vital interests | (d) | It is needed to protect someone's life. | Rarely relevant to a website. |
| Public task | (e) | You carry out official functions or tasks in the public interest set out in law. | Mainly for public bodies. |
| Legitimate interests | (f) | You have a genuine reason, the processing is necessary for it, and it does not override people's interests. | Needs a three-part assessment, and people can object. |
The basis you choose has knock-on effects. Consent gives people the right to withdraw it at any time. Legitimate interests gives them the right to object. The right to data portability applies only to consent and contract. Choosing carefully now saves confusion when someone makes a request.
Typical website purposes and their usual basis
The table shows the basis most small businesses would normally use for common website activities. Your circumstances may differ, and the reasoning matters more than the label.
| Purpose | Usual basis | Notes |
|---|---|---|
| Processing and delivering an order | Contract | Name, address, items and payment are needed to fulfil it. |
| Keeping invoices and order records | Legal obligation | Tax and company law set minimum retention periods. |
| Answering a contact form enquiry | Legitimate interests, or contract if it is a quote request | Use the details only to reply, not for marketing. |
| Newsletter to people who signed up | Consent | PECR usually requires consent for marketing emails to individuals anyway. |
| Marketing emails to existing customers | Legitimate interests, with the PECR soft opt-in | Only for similar products, with an opt-out offered at sign-up and in every email. |
| Analytics and advertising cookies | Consent | PECR requires consent for non-essential cookies, so consent is the natural basis for the processing too. |
| Fraud checks and site security | Legitimate interests | Keep the checks proportionate to the risk. |
| Customer accounts and login | Contract | For the account itself. Optional extras need their own basis. |
| Reviews and testimonials published with a name | Consent, or legitimate interests where clearly expected | Tell people how their review will be shown and let them ask for removal. |
A legitimate interests assessment you can adapt
If you rely on legitimate interests, the ICO expects you to be able to show you considered three questions: is there a legitimate purpose, is the processing necessary for it, and do the person's interests override yours? Writing the answers down is called a legitimate interests assessment, or LIA. For a small business it can be half a page per purpose.
Purpose: Emailing past customers about new products in the same range
Business: Harbourside Candles Ltd (fictional example)
1. Purpose test
Why? To tell existing customers about products similar to those
they bought, which supports repeat sales.
Legitimate? Yes. Direct marketing can be a legitimate interest.
2. Necessity test
Needed? Email is the channel customers chose to deal with us through.
Less
intrusive? Monthly at most; similar products only; no data sharing.
3. Balancing test
Expected? Yes. Customers were told at checkout and could opt out there.
Impact? Low. One email a month, unsubscribe link in every message.
Vulnerable? No children or vulnerable groups targeted.
Safeguards? Opt-out honoured promptly; suppression list kept.
Outcome: Legitimate interests applies, together with the PECR soft opt-in.
Reviewed: September 2026, next review September 2027If the balancing test comes out against you, for example because people would be surprised or the impact is significant, legitimate interests is the wrong basis. Consider consent, or do not carry out the processing.
The fix, step by step
Step 1
List each purpose separately
Open a spreadsheet and write one row for each reason you use personal data, not one row per system. Go through the website page by page: forms, checkout, accounts, newsletter sign-up, comments, cookies and scripts, live chat and any embedded tools. Add offline purposes such as invoicing, staff records and supplier contacts. Separate purposes that share data, such as delivering an order and later marketing to the same customer, because each needs its own basis.
Step 2
Match each purpose to one basis
For every row, choose the basis that fits the real reason for the processing, using the six bases in Article 6. Ask whether the processing is genuinely necessary for a contract, required by a named law, or something you want to do for your own reasons. Where two bases seem to fit, choose the one that honestly reflects your relationship with the person, then write a sentence explaining why you chose it.
Step 3
Check any consent meets the standard
For each purpose that relies on consent, look at how you actually collect it. Boxes must be unticked by default, the wording must say what people are agreeing to and who you are, consent must not be a condition of buying unless it is truly needed, and withdrawing must be as easy as agreeing. Keep a record of who consented, when, how and to what wording. If you cannot meet all of this, consent is not valid.
Step 4
Write a legitimate interests assessment
For each purpose resting on legitimate interests, write a short assessment covering the purpose, necessity and balancing tests. Think honestly about whether people would expect the processing, what impact it could have on them, and what safeguards reduce that impact. Store the assessment with your records and review it when the processing changes. If the balancing test fails, switch to consent before you start, or drop the purpose.
Step 5
Add a condition for sensitive data
Check whether any purpose involves special category data, which includes health, ethnic origin, religious beliefs, sexual orientation, biometric and genetic data, or data about criminal offences. These need a lawful basis and an additional condition under Article 9 or 10 and the Data Protection Act 2018, often with an appropriate policy document. Clinics, therapists, gyms and booking forms that ask about health are common places where this is missed.
Step 6
Check marketing against PECR as well
A lawful basis under the UK GDPR is not enough on its own for electronic marketing. The Privacy and Electronic Communications Regulations generally require consent before sending marketing emails or texts to individuals, with the soft opt-in exception for existing customers offered similar products and a clear opt-out. Check each marketing purpose against both sets of rules and make sure the sign-up forms support the approach you chose.
Step 7
Record the basis and publish it
Copy the purpose and basis columns into your records of processing activities and into your privacy notice, where each purpose should be listed with its basis in plain words. Where you rely on legitimate interests, say what those interests are. Where you rely on consent, explain how to withdraw it. Then compare the notice with the live site to check that every form and script you found is covered.
Recognised legitimate interests and other 2025 changes
The Data (Use and Access) Act 2025 adds a seventh basis to Article 6, known as recognised legitimate interests. It covers a short list of purposes set out in the Act, such as responding to emergencies, detecting and preventing crime, safeguarding vulnerable people, national security and some disclosures requested by public bodies. For those listed purposes, the balancing test is not required, although the processing must still be necessary.
The Act also gives examples of activities that may be carried out as ordinary legitimate interests, including direct marketing, sharing data within a group of companies for internal administration, and keeping networks and information systems secure. These are examples, not automatic approvals: you still need the three-part assessment for them.
For most small-business websites, the practical effect is limited. Order handling, marketing and analytics work much as before. If you think a recognised legitimate interest applies to you, read the ICO's guidance on it first, and note the date the relevant provision came into force.
Mistakes that make a basis invalid
- Consent for everything. It sounds cautious but creates problems: people can withdraw it, and you may not be able to stop the processing when they do.
- Switching after the event. Moving from consent to legitimate interests because consent was withdrawn, or because consent turned out to be invalid, is generally not acceptable.
- Legitimate interests as a catch-all. Naming it without an assessment, or using it for processing people would not expect, such as selling their data.
- Bundled consent. One tick box that covers terms, marketing and data sharing is not specific.
- A policy that does not match the site. Listing "consent" for analytics while scripts load before the banner is answered, which the tracking before consent guide covers.
- Forgetting old purposes. Data collected for one reason, such as a competition entry, cannot simply be reused for another, such as a mailing list, unless the new purpose is compatible or you have a new basis.
1. What are the six lawful bases under UK GDPR?
They are consent, contract, legal obligation, vital interests, public task and legitimate interests, set out in Article 6. You need one of them for each purpose you use personal data for. Consent gives people a choice; contract covers what is necessary to deliver something they asked for; legal obligation covers what the law requires; and legitimate interests covers other reasonable purposes that pass a balancing test. The 2025 Act adds recognised legitimate interests for a short list of purposes.
2. Should a small business rely on consent or legitimate interests?
It depends on the purpose, not on the size of the business. Consent suits genuinely optional activities where you want people to choose, such as a newsletter for people who are not customers or advertising cookies. Legitimate interests suits reasonable activities people would expect, such as fraud prevention or answering an enquiry, where you can show the processing is necessary and fair. Neither is a safer default, and each purpose should be considered separately.
3. Can I change my lawful basis later?
Generally you should not switch basis for an existing purpose, especially from consent to something else after people have withdrawn consent or where the consent was invalid. That would be unfair to the people involved. If your purpose genuinely changes, you may need a new basis for the new purpose and must tell people. The safest approach is to choose carefully at the start and document why the basis fits.
4. Do I need consent to send a newsletter?
For marketing emails to individuals, the Privacy and Electronic Communications Regulations generally require consent, whatever your UK GDPR basis. The exception is the soft opt-in: you can email existing customers about your own similar products if you collected their details during a sale or negotiation, gave them a chance to opt out at the time, and offer an opt-out in every message. Emails to corporate addresses follow different rules, but individuals can still object.
5. What is a legitimate interests assessment?
It is a written record of three tests: whether your purpose is legitimate, whether the processing is necessary to achieve it, and whether the person's interests, rights and freedoms override yours. The UK GDPR does not prescribe a format, but the ICO expects you to be able to show you considered these questions. For a small business, half a page per purpose is usually enough, reviewed when the processing changes or someone objects.
6. What is recognised legitimate interests?
It is a new lawful basis added by the Data (Use and Access) Act 2025. It applies to a short list of purposes set out in the Act, such as emergencies, crime prevention, safeguarding and national security, and for those purposes you do not need to carry out the balancing test. It does not cover everyday commercial activities such as marketing or analytics. Check the ICO's guidance and whether the provision is in force before relying on it.
7. Where do I need to record my lawful basis?
In your privacy notice, so people know the basis for each purpose, and in your internal records of processing activities. Organisations with fewer than 250 employees have a partial exemption from keeping full records, but still need records for processing that is regular, risky or involves special category data, which covers most website processing. Keep any legitimate interests assessments and consent records alongside, so you can show your reasoning if asked.
The GDPR Audit checks what a visitor can see, including the privacy policy, the cookie banner and scripts that load before consent, so you can compare the lawful basis you state with what the site really does.
Open GDPR Fixes →