A practical guide to the seven lawful bases under UK GDPR, the conditions for valid consent, the new recognised legitimate interests basis introduced by the DUAA 2025, and the rules for children's consent.

Consent is one of seven UK GDPR lawful bases. Choose the basis that fits the purpose and circumstances before processing starts; consent is appropriate only where people can make a genuine choice and withdraw it.

This guide covers the seven lawful bases, when to use each, the conditions for valid consent, the new recognised legitimate interests basis, and the rules for processing children's data.

The 7 lawful bases of UK GDPR

Lawful bases before and after the DUAA — six to seven

UK GDPR now provides seven lawful bases. The Data (Use and Access) Act 2025 added recognised legitimate interest, which became available on 5 February 2026. EU GDPR retains six lawful bases.

  1. Consent — the individual has given consent to the processing for one or more specific purposes.
  2. Contract — processing is necessary for the performance of a contract with the individual, or to take steps at the individual's request before entering into a contract.
  3. Legal obligation — processing is necessary for compliance with a legal obligation to which the controller is subject.
  4. Vital interests — processing is necessary to protect the vital interests of the data subject or another person.
  5. Public task — processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
  6. Legitimate interests — processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where overridden by the interests, rights, and freedoms of the individual.
  7. Recognised legitimate interests — processing is necessary for a specific list of public-interest purposes set out in Schedule 4 of the DUAA, including crime prevention, safeguarding, emergency response, and national security.

No basis is more important than the others. The right basis depends on the relationship with the individual, the purpose of the processing, and the practical context. You should identify and document the basis before processing begins, and the choice will normally appear in your privacy notice.

Special category data also needs an Article 9 condition and, where required, a Schedule 1 condition under the Data Protection Act 2018. Criminal offence data needs official authority or applicable legal authorisation, normally a Schedule 1 condition.

When to use each basis

Which lawful basis to use — decision tree

A few rules of thumb. None of them are absolute — your circumstances may pull a different way — but they reflect how the bases are most commonly applied.

Consent is appropriate when you genuinely want to give the individual a real choice, the choice isn't tied up with the provision of a service, and you can demonstrate the individual freely agreed. Marketing communications, optional cookie tracking, and processing of special category data in research contexts are typical examples.

Contract fits when the processing is genuinely necessary to perform a contract the individual is party to. Sending an order confirmation is contract; sending a "we noticed you abandoned your basket" email is not — that's marketing, which needs a different basis.

Legal obligation applies where processing is necessary to meet a UK legal duty, rather than a contractual obligation. Identify the relevant statutory or common-law obligation, or a sufficiently clear legal requirement, and explain why the processing is necessary.

Vital interests is narrow. It covers life-or-death situations — passing a patient's medical details to A&E, sharing information that prevents physical harm. It is rarely the basis for routine processing.

Public task is for public authorities and bodies performing tasks set out in law. A local council processing council tax data, a school administering admissions, an NHS trust running clinical services.

Legitimate interests can support commercial and other activities where the purpose, necessity and balancing tests are met. Document the assessment and consider whether people would reasonably expect the processing and its effect on them. Public authorities cannot use it for their official tasks.

Recognised legitimate interest covers the specific purposes in the statutory list. It removes the balancing test, but processing must still be necessary and meet the conditions of the relevant purpose. It is not a general exemption from assessing or documenting the activity.

Consent has specific conditions. It must be freely given, specific, informed and unambiguous, with a clear affirmative action. Organisations must be able to demonstrate it and make withdrawal as easy as giving consent.

Freely given

People must have a genuine choice. Making a service conditional on consent to unnecessary processing can invalidate consent. Assess the relationship, any imbalance of power, detriment and available alternatives rather than assuming a signed or clicked agreement is freely given.

Specific

Consent must be for a specific purpose. Lumping multiple purposes together — "we may use your data for marketing, analytics, research, and other purposes" — is not valid consent. Each purpose needs its own opt-in.

Informed

The individual must understand what they are consenting to. The purpose, the controller's identity, the type of data, and the right to withdraw must all be clear before consent is given.

Unambiguous

The agreement must be clear. Silence, inactivity, or pre-ticked boxes do not count. The Planet49 case at the CJEU confirmed that pre-ticked checkboxes are not valid consent under GDPR — a position the UK has retained.

A clear affirmative action

Ticking an unchecked box, clicking an explicit "Accept" button, signing a form. The action must be unmistakeable.

You also need to be able to demonstrate that consent was obtained. Records of when consent was given, what the individual was told, and the form of agreement are part of the accountability requirement.

Explicit consent requires an express statement, rather than relying only on conduct. It can provide an Article 9 condition and is relevant to certain restricted significant automated decisions involving special category data under Article 22B.

Explicit consent is required for:

  • Processing of special category data, where consent is the chosen Article 9 condition.
  • Certain significant solely automated decisions using special category data, where the organisation relies on the explicit-consent route under Article 22B and provides the required safeguards.
  • An exceptional restricted international transfer under Article 49(1)(a), after informing the person of the possible risks arising from the absence of an adequacy decision and appropriate safeguards.

The practical implication: where you process health information, biometric data, or other special category data on the basis of consent, you need a specific opt-in that names the special category and the purpose. A generic privacy consent does not satisfy the explicit consent standard.

Article 7(3) gives individuals the right to withdraw consent at any time, and requires that it must be as easy to withdraw as it was to give. If you obtained consent through a single click, withdrawal cannot require a phone call, a written letter, or three weeks of waiting.

If someone withdraws consent, stop the processing that relied on it. Do not retrospectively switch to another basis to evade withdrawal. Separate processing may continue only where an appropriate independent basis already applies; delete information that is no longer lawfully needed.

Where consent is the only basis you rely on and the individual withdraws it, you generally need to delete the data. Trying to switch to legitimate interests after the individual has withdrawn consent is almost never defensible.

Consent for children

Article 8 applies where an information society service is offered directly to a child and processing relies on consent. It does not require parental consent for every online service or every use of children's information.

For this consent-based processing, the UK threshold is 13. Below that age, consent normally needs authorisation from the holder of parental responsibility, and the provider must make reasonable efforts to verify it. Specific exceptions apply to preventive or counselling services.

The DUAA also requires providers of online services likely to be accessed by children to consider specified children's protection matters when designing their processing. This sits alongside the Children's Code and the other UK GDPR safeguards.

Outside Article 8, assess whether the child can understand the processing and make the relevant decision. Use age-appropriate information, consider the context and the child's rights, and do not assume that collecting parental consent always resolves the issue.

Recognised legitimate interests (RLI)

The Data (Use and Access) Act 2025 introduced a seventh lawful basis under Article 6(1)(ea) of the UK GDPR: recognised legitimate interests. It applies to a specific list of public-interest purposes set out in Schedule 4 of the DUAA, including:

  • Crime prevention and detection.
  • Safeguarding vulnerable people.
  • Responding to emergencies.
  • Safeguarding national security.
  • Disclosing information to a person carrying out a public task, where that person requests it and states that it is needed for that task, subject to the statutory conditions.

The recognised legitimate interest basis removes the balancing limb of the ordinary legitimate interests assessment. Record the applicable listed purpose, why processing is necessary and how its conditions and the remaining data protection duties are met.

The key limitation is that the list is narrow. Most commercial processing will still rely on standard legitimate interests under Article 6(1)(f), with a full LIA. RLI is not a general-purpose alternative to consent or contract.

For purposes outside the recognised list, assess another lawful basis. Direct marketing may fall under ordinary legitimate interests, but PECR consent or soft opt-in requirements must also be met where they apply.

For more on where RLI fits in the wider regime, see our UK GDPR vs EU GDPR guide.

Common consent mistakes

A few patterns to avoid:

  • Pre-ticked boxes do not demonstrate a clear affirmative choice and cannot provide valid consent. The Planet 49 judgment confirmed that principle for cookies.
  • A cookie wall can prevent a genuine free choice. Assess any proposed consent-or-pay arrangement against the ICO's detailed guidance, including the power balance, an appropriate fee and an equivalent alternative; it is not automatically valid or invalid merely because a paid alternative exists.
  • Bundled consent. Asking for one consent to cover marketing, analytics, third-party sharing, and "other purposes" all at once. Each purpose needs its own opt-in.
  • Hard-to-withdraw consent. Article 7(3) requires withdrawal to be as easy as the original consent. A click to opt in cannot require a letter to opt out.
  • Choose the basis that actually fits the processing. Asking for consent when the organisation intends to process the information regardless can mislead people about their choices and rights.
  • Treating consent as permanent. Consent given in the past may no longer be valid if circumstances have materially changed, or if the original consent fell short of the current standard.

For broader context, see our hub guide to UK GDPR and our seven principles guide. For cookie consent specifically, which has its own rules under PECR, see our cookie consent guide.

Frequently asked questions

How many lawful bases are there under GDPR?

UK GDPR has seven lawful bases following the DUAA change: consent, contract, legal obligation, vital interests, public task, legitimate interests and recognised legitimate interest. EU GDPR continues to have six.

When is consent the right lawful basis?

When the individual has a genuine choice, the choice is not tied to the provision of a service, and you can demonstrate that consent was freely given, specific, informed, and unambiguous. Marketing communications and processing special category data in research contexts are typical examples.

Can I rely on legitimate interests instead of consent?

Often yes, particularly in commercial contexts. Legitimate interests requires a documented assessment (an LIA) that shows your interests are not overridden by the individual's rights. You cannot rely on legitimate interests for cookies that need consent under PECR.

What is recognised legitimate interest?

Recognised legitimate interest is available only for the listed statutory purposes. It removes the balancing test, but necessity, the conditions of the relevant purpose and the other data protection duties still apply.

Can children give consent under GDPR?

For an online service offered directly to a child that relies on consent, the UK Article 8 threshold is 13. Below that age parental authorisation is normally needed. Other processing requires a separate assessment of the appropriate lawful basis and safeguards.

Make sure your team understands lawful bases, consent and data protection law.

Explore the GDPR & Data Protection Course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.