Lawful basis
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Lawful basis - One of the six legal grounds in Article 6 (consent, contract, legal obligation, vital interests, public interest, legitimate interests). Processing needs at least one.
In the CIPP/E body of knowledge, Lawful basis comes up under Ch 6.2 - Lawfulness, fairness, transparency.
Lawful basis in context
- A [[controller]] is the person or body that ==alone or jointly determines the purposes and means== of processing - the ==key decision-maker==, who carries ==most GDPR responsibilities and liability== (information notices, lawful basis, rights, DPIAs, security, breach notification). (Controller vs Processor - Roles and Liability)
- Whatever lawful basis is used, employers must still give employees a clear [[notice]] about how their data is used. (Providing notice)
- Monitoring needs a lawful basis - usually the [[legitimate-interests balancing test]], not [[consent]], whose use the [[WP29]] said is ==very limited== for monitoring. (Legitimacy and proportionality of monitoring)
Where Lawful basis is covered in the CIPP/E study notes
Related terms
- Fairness
- Transparency
- Legitimate interests
Test yourself on Lawful basis
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.