When may I process personal data?

Six legal bases, and consent is just one of them

Processing personal data is permitted when one of the six legal bases under Article 6 of the GDPR applies. Consent is the most well-known legal basis, but it is not the only one and in practice is often not the most obvious: processing can also be lawful because it is necessary for the performance of a contract, because there is a legal obligation behind it, to protect a vital interest, for the performance of a task carried out in the public interest, or because a legitimate interest of the organization outweighs the interest of the data subject in not being processed.

For an online shop or service provider, usually three of these legal bases appear: the contract (a customer orders something, and the data is needed to be able to deliver), the legal obligation (an invoice that must be retained under tax rules), and the legitimate interest (for example, security of the website, or a newsletter to existing customers). Consent comes into play when none of the other legal bases apply, such as in marketing to people who are not yet customers — and for that consent it applies that it must be specific, freely given, and demonstrable.

This is stated in Article 6 of the GDPR

Article 6(1) of the GDPR lists the six legal bases under letters (a) to (f); which legal basis applies to a specific processing follows from the nature of that processing itself and not from a choice that has already been made beforehand. The Dutch Data Protection Authority provides further guidance on the application of these legal bases in practice on its website.