Article 6 (GDPR - Lawful Basis)

The GDPR provision establishing the six legal bases that justify processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Every data processing activity must have at least one of these lawful bases—it's the foundation of GDPR compliance. Article 6 requires you to identify and document your lawful basis before processing begins. You can't switch bases arbitrarily, though you can have different bases for different processing purposes. Consent requires freely given, specific, informed agreement. Contract covers processing necessary to fulfill agreements with the individual. Legal obligation applies when law requires you to process data. Vital interests protect someone's life or physical safety. Public task covers public authorities and public interest missions. Legitimate interests balance your business needs against individual rights—it's flexible but requires careful assessment. Choosing the wrong lawful basis is a common compliance mistake with serious consequences.