The six lawful bases: the question every processing must answer

Every use of your data needs exactly one of six justifications (Art. 6). (1) Consent — freely given, specific, informed, revocable; invalid when extracted by design pressure or bundled into terms. (2) Contract — what performing YOUR contract genuinely requires: the shop needs your delivery address, not your birthday. (3) Legal obligation — tax retention, AML checks; the law must actually command it. (4) Vital interests — life-or-death emergencies, rare. (5) Public task — governments doing statutory jobs. (6) Legitimate interest — the elastic one, with its mandatory balancing test. Why you care: the basis determines your counter-moves. Consent-based? Withdraw. Legitimate interest? Object. Contract? Check necessity — padding beyond necessity has no basis at all. And the basis must be named in the privacy policy per purpose (Art. 13(1)(c)) — a policy that lists all six “as applicable” is a transparency violation you can cite. Special-category data (health, biometrics…) needs an Art. 9 exception on top — see special categories.