Legal basis for processing

A legal basis for processing is the ground, drawn from the closed list in Art. 6(1) GDPR, that makes a processing operation lawful. The six bases are: the data subject's consent (a); necessity for the performance of a contract with the data subject (b); necessity for compliance with a legal obligation to which the controller is subject (c); protection of the vital interests of a natural person (d); necessity for the performance of a task carried out in the public interest or in the exercise of official authority (e); and necessity for the legitimate interests pursued by the controller or a third party, unless overridden by the interests or fundamental rights of the data subject (f).

Bases (c) and (e) require a foundation in Union or Member State law. The EDPB insists that the controller identify the basis before processing starts, document it in the record of processing activities and communicate it in the information notice; switching bases afterwards is not permitted. Where the data belongs to a special category, an additional exception under Art. 9(2) is required, most often explicit consent (a), health care (h), public health (i) or scientific research (j).

In life sciences the mapping is typically: legal obligation and public health for pharmacovigilance and regulatory reporting; public interest or legitimate interest with the research exception for trial conduct; contract for a patient-facing app's core service; and consent for optional features, marketing and some secondary uses. National law can change this mapping: French reference methodologies, for example, prescribe the bases to be used. A written legal-basis matrix per purpose is one of the first deliverables of a gap analysis.