Lawful basis

Start with the purpose

A lawful basis is the legal reason for processing personal data for a particular purpose. Define that purpose first. “For HR” is too broad to explain why you need a candidate's bank details, an employee's absence record or a former worker's contact information.

The current seven bases are consent, contract, legal obligation, vital interests, public task, recognised legitimate interests and legitimate interests. There is no preferred basis. The ICO's lawful-basis guide expects the chosen one to fit the actual processing.

Choose the basis that actually fits

Contract can cover information genuinely necessary to perform an employment contract. Legal obligation can apply to a statutory duty. Legitimate interests needs a justified purpose, necessity and a balance against the person's interests and rights. Recognised legitimate interests applies only to the purposes set out in law, so it is not a general shortcut for ordinary HR work.

Necessity means the processing is targeted and proportionate. Convenience is not enough if a less intrusive approach would achieve the purpose. Consent is often unsuitable for employee information because the worker may not have a genuinely free choice.

Document it before collection

Choose and record the basis before processing starts, then state the purpose and basis in your privacy information. Keep the people, information, necessity, recipients, safeguards and review owner beside that decision. If the purpose genuinely changes, assess the new use instead of silently stretching the old wording.

Do not switch basis retrospectively because consent was withdrawn or the original choice became inconvenient. Special category or criminal-offence information also needs its additional condition. Recording the reasoning while it is fresh makes later reviews, rights requests and changes much easier to handle honestly.