GDPR Article 6: six lawful bases, not just consent

GDPR Article 6 lists six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Many people mistakenly think consent is the only option, but it is just one of six. For example, an employer processing payroll does not need consent—they rely on legal obligation or contract. The key contrast is that consent requires a clear, affirmative action from the data subject, whereas other bases often stem from legal duties or organisational needs.

To eliminate wrong answers in a question, first check if the processing is required by law or a contract—if yes, consent is not needed. Second, remember that 'vital interests' applies only to life-or-death situations, like emergency medical care. Third, 'legitimate interests' is the broadest base but cannot override the data subject's rights; it often covers fraud prevention or direct marketing. A quick elimination trick: if the scenario involves a public authority, 'public task' is likely the base, not consent.

To test yourself, ask: 'Does this processing happen because of a legal duty, a contract, or a life-saving need?' If yes, cross out consent. For a memory aid, think of the six bases as 'C-C-L-V-P-L' (Consent, Contract, Legal obligation, Vital interests, Public task, Legitimate interests). Practise matching each base to a real-world example, like payroll (contract/legal obligation) versus a newsletter sign-up (consent).