008.014

Lawful Bases for Processing

The "legal reason" you're allowed to send. Under GDPR, you can't just "send mail." You must have a Lawful Basis. For marketing, this is almost always "Consent." For transactional mail, it's "Legitimate Interest" or "Performance of a Contract."

10 questions in this topic

What are the six lawful bases under GDPR? How do “consent” and “legitimate interest” differ in practice? What is “contractual necessity” as a legal basis? What is “legal obligation” as a basis for transactional email? How to document the chosen lawful basis? How does “public interest” rarely apply to marketing? When can you switch lawful bases? What happens when you lose your lawful basis? What is “balancing test” for legitimate interest? How do lawful bases impact suppression handling?