Lawful basis
By Gareth HoyleLast updated How we research
A lawful basis is a legal ground under Article 6 of UK GDPR or EU GDPR that an organization needs before it can use personal data.
A lawful basis is the legal ground an organization relies on to process personal data under Article 6 of UK GDPR or EU GDPR. It is a UK and EU concept with no direct US equivalent.
Does US law require a lawful basis?
US privacy laws do not use the lawful basis model. The CCPA works mainly through notice and consumer rights, including the right to know, the right to delete and the right to opt out of the sale or sharing of personal information, according to the California Attorney General.
FTC staff warned in February 2024 that using data for AI training under a surreptitious, retroactive change to a privacy policy may be unfair or deceptive.
How many lawful bases are there under UK GDPR?
There are seven lawful bases under UK GDPR following the Data (Use and Access) Act 2025, and the ICO updated its guide on April 2, 2026 to reflect this: consent, contract, legal obligation, vital interests, public task, recognized legitimate interest and legitimate interests. EU GDPR still has six.
Which lawful basis applies when selling data for AI?
Legitimate interests and consent are the bases most often considered for disclosing personal data to an AI buyer, and either is hard to rely on if the privacy notice in force at collection never mentioned it. If the data is properly anonymized, UK GDPR no longer applies. Take independent advice and read our guide to UK GDPR, EU GDPR and CCPA when selling data.