GDPR Article 6 — Lawfulness of processing

Article 6(1) — Lawful bases for processing

Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent; processing is necessary for a contract; processing is necessary for a legal obligation; processing protects vital interests; processing is necessary for a public-interest task or official authority; or processing is necessary for legitimate interests that are not overridden by the data subject's interests or fundamental rights and freedoms.

Article 6(2) — More specific Member State provisions

Member States may maintain or introduce more specific provisions for processing under Article 6(1)(c) and (e), including requirements and measures that ensure lawful and fair processing.

Article 6(3) — Legal basis in Union or Member State law

The basis for processing under Article 6(1)(c) and (e) shall be laid down by Union or Member State law. The legal basis may specify processing conditions, data categories, data subjects, recipients, purposes, storage periods, operations, and safeguards.

Article 6(4) — Further processing compatibility

For processing for a different purpose without consent or a legal basis, the controller shall consider links between purposes, collection context, the nature of the data, consequences for data subjects, and appropriate safeguards such as encryption or pseudonymisation.