GDPR Lawful Basis for Processing (Article 6): The Six Bases

The Six Bases (Article 6(1))

Legitimate Interests in Practice

Security monitoring and SIEM retention often rely on legitimate interests when carefully scoped — see GDPR and SIEM logs. Always balance necessity against data-subject impact and keep the Legitimate Interests Assessment (LIA) with your RoPA.

How CyberSilo Helps

• CSA links each processing row to a documented Article 6 basis
• Flags new data flows without a recorded basis
• Supports notice and rights workflows that reference the chosen basis

Frequently Asked Questions

How many lawful bases does GDPR have?

Six under Article 6(1)(a–f): consent, contract, legal obligation, vital interests, public task, and legitimate interests.

Is consent always required?

No. Consent is one basis. Contract and legitimate interests are common for SaaS and security processing when conditions are met.

What is a Legitimate Interests Assessment?

A documented three-part test (purpose, necessity, balancing) used when relying on Article 6(1)(f).

Related GDPR Resources

GDPR hub · Principles · Consent & cookies · RoPA · CSA