GDPR lawful basis explained: the six grounds for processing personal data
· 2h ago · Originally reported by PPC Land
This is an explainer of 'lawful basis,' the GDPR requirement that an organisation identify one of six legal grounds — such as consent or legitimate interests — before processing personal data. No news event, deal, or enforcement action is reported.
Why it matters
Every ad tech company that targets or measures ads on personal data must point to a lawful basis, so this concept underpins how much of digital advertising can legally operate in Europe.
Explain it like I’m new here
Before you borrow someone's stuff, you need a valid reason they'd accept — GDPR says the same about using people's personal data, with six acceptable reasons on the list.
Terms in this story
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
Legitimate interest
Legitimate interest is one of the GDPR's six lawful bases for processing personal data, allowing processing without consent when it is necessary for a genuine interest not overridden by the individual's rights.
PII (personally identifiable information)
PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Go deeper
Related stories
Explainer: What a Legitimate Interests Assessment Under GDPR Involves
This piece breaks down the legitimate interests assessment (LIA), the documented analysis companies must complete before processing personal data under Article 6(1)(f) of the GDPR. It covers the three core steps: identifying a legitimate…
US web tracking lawsuits drive $1.4bn in 2026 settlements, healthcare firms hit hardest
A Privado analysis of 2026's web tracking-related settlements found US companies paid $1.4 billion to resolve such cases. Meta's tracking pixel appeared in 100 of 116 settlements reviewed, and healthcare firms accounted for 64% of…
Opinion: What Publicis' Ownership of LiveRamp Means for Brand Data Independence
An Adweek op-ed argues that holding companies acquiring data infrastructure like LiveRamp creates conflicts of interest, since one owner would control the plumbing that connects multiple competing brands to their customer data. The author…
Zee5 Rolls Out ZAP Privacy-First Audience Intelligence Tool for Advertisers
Zee5 has launched ZAP, a privacy-first audience intelligence product aimed at digital advertising. The tool is positioned to help advertisers understand audiences without relying on invasive data practices. Details on methodology and…
Marketers Weigh Pros and Cons After Publicis Completes LiveRamp Acquisition
Following Publicis' completed acquisition of LiveRamp, marketers are considering whether to continue using LiveRamp's services under its new ownership. The decision centers on how the acquisition may impact data connectivity, privacy, and…
Grindr Acquires HIV Prevention Provider Freddie for $250 Million
Grindr has acquired Freddie, a provider of HIV prevention services, for $250 million, with an additional $70 million contingent on 2027 performance. The deal enables US and Canadian users to access Freddie's services directly from Grindr's…