Reasons for Collecting Personal Data
A helpful guide
💭 Ask yourself...
"Can I explain why I'm collecting this information, and have I explained that to the individual?"
If the answer is no...
That's probably where you should start.
Short answer
Every time you collect or use personal information, you need a valid legal reason.
Under UK GDPR, this legal reason is known as a lawful basis.
Your lawful basis isn't just an internal decision. Wherever appropriate, you should tell people why you're collecting their information and how you'll use it.
Choosing the correct lawful basis from the start helps build trust and ensures your processing is fair and transparent.
Why is this important?
One of the most common misunderstandings is that organisations can choose whichever lawful basis suits them at the time.
That's not how it works.
Your lawful basis should reflect the real reason you're processing the information. It isn't something you should change later simply because another basis appears more convenient.
For example, if you asked someone for consent to send them marketing emails, you shouldn't later decide that you're relying on legitimate interests for the same processing without carefully considering whether that change is appropriate and ensuring your privacy information remains accurate and transparent.
Transparency is a fundamental part of good data protection. People should understand what you're doing with their information and why.
The six lawful bases
📄 Consent
The individual has given you clear permission to use their information for a specific purpose.
Example: Signing up to receive a marketing newsletter.
📄 Contract
You need the information because it's necessary to fulfil a contract or take steps before entering into one.
Example: Using a customer's address to deliver an order.
📄 Legal obligation
You need to process information because the law requires you to.
Example: Keeping payroll records for HMRC.
📄 Vital interests
You need to use personal information to protect someone's life.
This basis is rarely used in day-to-day business.
📄 Public task
Used mainly by public authorities carrying out official functions.
Most private businesses won't rely on this basis.
📄 Legitimate interests
You have a genuine business reason for processing personal information, provided that it doesn't override the rights and freedoms of the individual.
This basis usually requires a balancing exercise and should be considered carefully.
Can more than one lawful basis apply?
Yes—but usually for different processing activities, not the same one.
For example, an employer may:
- rely on contract to pay an employee's salary;
- rely on legal obligation to report information to HMRC;
- rely on legitimate interests to protect business systems from misuse.
Each activity has its own lawful basis.
It's perfectly normal for an organisation to rely on several lawful bases across different parts of its business.
Can you change your lawful basis?
Sometimes—but not simply because another lawful basis is more convenient.
If the purpose for processing changes, or the circumstances change significantly, you may need to review your lawful basis.
Where appropriate, you should also ensure your privacy information is updated so individuals understand how their information is being used.
The key principle is transparency. People shouldn't be surprised by how their information is used.
Practical steps
Before collecting personal information:
- Decide why you're collecting it.
- Identify the most appropriate lawful basis.
- Record your reasoning where appropriate.
- Explain your processing clearly in your privacy notice.
- Keep your lawful basis under review if your processing changes.
Common misconceptions
❌ "Consent is always the safest option."
Not necessarily.
If another lawful basis is more appropriate, asking for consent can actually create problems because consent must be freely given and capable of being withdrawn.
❌ "I can switch to legitimate interests later."
Not automatically.
Your lawful basis should reflect the reality of your processing, and any changes should be carefully considered and communicated where necessary.
❌ "One lawful basis covers everything."
Usually not.
Most organisations rely on different lawful bases for different processing activities.
🤝 Need a little support?
Choosing the correct lawful basis is one of the most important decisions you make when processing personal information. Getting it right at the start makes many other compliance decisions much easier.
If you're unsure which lawful basis applies, reviewing a new process or updating your privacy notice, we're happy to help.
Sometimes a short conversation can prevent much bigger issues later.
Related Guides:
Do I Need to Register with the ICO?