Art. 6 GDPR · Chapter II: Principles
Article 6 GDPR: Lawfulness of processing
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Processing is lawful only if at least one of six grounds applies: consent, contract, legal obligation, vital interests, public interest or official authority, or legitimate interests. The article also sets out how Union or Member State law can lay down a basis for processing, and what the controller must take into account when data are processed for a new purpose without consent or such a law.
Official text
Processing shall be lawful only if and to the extent that at least one of the following applies:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
processing is necessary for compliance with a legal obligation to which the controller is subject;
processing is necessary in order to protect the vital interests of the data subject or of another natural person;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
Union law; or
Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:
any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
the possible consequences of the intended further processing for data subjects;
the existence of appropriate safeguards, which may include encryption or pseudonymisation.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others
Judgment of 14 July 2026ECLI:EU:C:2026:579
Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.
- C-484/24, NTH Haustechnik GmbH v EM
Judgment of 18 June 2026ECLI:EU:C:2026:496
National procedural rules that require courts to consider all evidence submitted by the parties can be a valid legal basis for processing personal data in that evidence, provided clear and foreseeable national case-law sets the conditions for its use.
- C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect
Judgment of 9 January 2025ECLI:EU:C:2025:2
Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.
- C-65/23, MK v K GmbH
Judgment of 19 December 2024ECLI:EU:C:2024:1051
Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.
- C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens
Judgment of 4 October 2024ECLI:EU:C:2024:858
A purely commercial interest, such as selling members' data to sponsors, can be a legitimate interest if it is lawful, but the processing must be strictly necessary and pass the balancing test.
- C-17/22, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV
Judgment of 12 September 2024ECLI:EU:C:2024:738
Giving one investor the contact details of all indirect investors in a fund can be necessary for the contract only if objectively indispensable to it; it may otherwise rest on legitimate interest if strictly necessary and the balance favours it.
- C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts
Judgment of 21 December 2023ECLI:EU:C:2023:1022
A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.
- C-26/22, UF and AB v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:958
Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.
- C-634/21, OQ v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:957
Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person.
- C-319/22, Gesamtverband Autoteile-Handel e.V. v Scania CV AB
Judgment of 9 November 2023ECLI:EU:C:2023:837
Vehicle-type rules create a legal obligation (Art. 6(1)(c)) on car manufacturers to make vehicle identification numbers available to independent operators as controllers; the Court also explained that a VIN can be personal data for someone who can reasonably link it to the vehicle's keeper.
- C-252/21, Meta Platforms Inc and Others v Bundeskartellamt
Judgment of 4 July 2023ECLI:EU:C:2023:537
A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.
- C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums
Judgment of 30 March 2023ECLI:EU:C:2023:270
National employment data rules that only repeat general GDPR conditions are not 'more specific rules' under Art. 88 and must be disapplied unless they are a valid legal basis under Art. 6(3).
- C-268/21, Norra Stockholm Bygg AB v Per Nycander AB
Judgment of 2 March 2023ECLI:EU:C:2023:145
When a civil court is asked to order disclosure of a document containing third parties' personal data, the GDPR applies and the court must weigh those persons' interests, applying proportionality and data minimisation.
- C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság
Judgment of 20 October 2022ECLI:EU:C:2022:805
Copying customer data into a test database can be compatible further processing under Art. 6(4), but keeping the data there longer than needed for testing breaches storage limitation.
- C-184/20, OT v Vyriausioji tarnybinės etikos komisija
Judgment of 1 August 2022ECLI:EU:C:2022:601
Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data.
- C-175/20, SIA 'SS' v Valsts ieņēmumu dienests
Judgment of 24 February 2022ECLI:EU:C:2022:124
A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1).
- C-439/19, Proceedings brought by B
Judgment of 22 June 2021ECLI:EU:C:2021:504
Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse.
- C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Judgment of 11 November 2020ECLI:EU:C:2020:901
The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder.
Related (earlier law or other instruments)
- C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA
Judgment of 17 June 2021ECLI:EU:C:2021:492
Instrument: GDPR together with the IP Enforcement and ePrivacy Directives
A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure.
- C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH
Judgment of 1 October 2019ECLI:EU:C:2019:801
Instrument: GDPR together with the ePrivacy Directive (Art. 5(3))
A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them.
- C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV
Judgment of 29 July 2019ECLI:EU:C:2019:629
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.
- C-582/14, Patrick Breyer v Bundesrepublik Deutschland
Judgment of 19 October 2016ECLI:EU:C:2016:779
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A dynamic IP address held by a website operator is personal data where the operator has lawful means to identify the user with additional data held by the internet access provider; national law may not exclude legitimate interest as a basis for such processing in advance.
EDPB guidance
- Guidelines 3/2025 on the interplay between the DSA and the GDPR
EDPB 03/2025FinalFirst published 12 September 2025Final version 17 September 2026
Version 2 is final.
- Guidelines 03/2026 on web scraping in the context of generative AI
EDPB 03/2026Draft for consultationFirst published 8 July 2026
Consultation open until 30 October 2026. Articles indicative.
- Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites
EDPB Rec 02/2025Draft for consultationFirst published 4 December 2025
Consultation closed; final not yet published.
- Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR
EDPB-COM DMA/GDPRDraft for consultationFirst published 9 October 2025
Joint text; consultation closed 4 December 2025; final not yet published.
- Guidelines 02/2024 on Article 48 GDPR
EDPB 02/2024FinalFirst published 3 December 2024Final version 5 June 2025
Version 2 is final.
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
EDPB Opinion 28/2024FinalFirst published 18 December 2024Final version 18 December 2024
Art. 64(2) opinion; date is EDPB publication date.
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
EDPB 01/2024Draft for consultationFirst published 9 October 2024
WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version.
- Guidelines 02/2021 on virtual voice assistants
EDPB 02/2021FinalFirst published 12 March 2021Final version 7 July 2021
- Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions
EDPB Rec 02/2021FinalFirst published 19 May 2021Final version 19 May 2021
- Guidelines 8/2020 on the targeting of social media users
EDPB 08/2020FinalFirst published 7 September 2020Final version 13 April 2021
- Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
EDPB 01/2020FinalFirst published 7 February 2020Final version 9 March 2021
Final version 2.0.
- Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR
EDPB 06/2020FinalFirst published 22 July 2020Final version 15 December 2020
- Guidelines 05/2020 on consent under Regulation 2016/679
EDPB 05/2020FinalFirst published 4 May 2020Final version 4 May 2020
Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8.
- Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak
EDPB 04/2020FinalFirst published 21 April 2020Final version 21 April 2020
Pandemic-specific.
- Guidelines 3/2019 on processing of personal data through video devices
EDPB 03/2019FinalFirst published 12 July 2019Final version 30 January 2020
- Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects
EDPB 02/2019FinalFirst published 12 April 2019Final version 16 October 2019
Fines
Amounts are shown in the currency in which the fine was imposed.
- Xandr Inc.: NOK 92,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 2 October 2026Appeal status: unknown
As an ad exchange in real-time bidding, processed Grindr users' data (revealing sexual orientation) without a legal basis, relying on Grindr's invalid consents.
- Experian Nederland B.V.: EUR 2,700,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 October 2025Appeal status: not appealed
Credit-scoring business used personal data from many sources without a valid legal basis and did not inform the people concerned.
- Luka Inc.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 April 2025Appeal status: unknown
AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors.
- Posti: EUR 2,400,000
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman, Finland), FinlandDecision of 13 November 2024Appeal status: unknown
Automatically opened an OmaPosti electronic mailbox for customers, tied to other services, with a pre-ticked box and without clear information.
Not fully confirmed: Confirmed on the EDPB news page. Fine for Art. 5 and 6(1); reprimand and order for Art. 13; instruction on Art. 25. Company name given only as 'Posti'.
- Foodinho s.r.l.: EUR 5,000,000
Garante per la protezione dei dati personali, ItalyDecision of 13 November 2024Appeal status: unknown
Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.
- LinkedIn Ireland Unlimited Company: EUR 310,000,000
Data Protection Commission (Ireland), IrelandDecision of 22 October 2024Appeal status: under appeal
Processed members' data for behavioural analysis and targeted advertising without a valid legal basis, and without fair and clear information.
- Clearview AI Inc.: EUR 30,500,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 May 2024Appeal status: not appealed
Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.
- Avast Software s.r.o.: CZK 351,000,000
Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Czech RepublicDecision of 10 April 2024Appeal status: upheld
Antivirus maker passed pseudonymised browsing histories of about 100 million users to a sister company that sold insights to marketers, while telling users the data was anonymous and used only for statistics.
- Amazon France Logistique: EUR 32,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 27 December 2023Appeal status: reduced
Warehouse employee monitoring: scanner-based productivity indicators kept in detail for 31 days, some judged to lack a legal basis, plus poor information to temporary staff and on CCTV, and weak security.
- EOS Matrix d.o.o.: EUR 5,470,000
Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), CroatiaAnnounced on 5 October 2023Appeal status: unknown
Debt collector could not protect or explain a leak from its main database, processed non-debtors' data and debtors' health data with no legal basis, and recorded calls without a legal basis or clear notice.
- Meta Platforms Ireland Limited: EUR 210,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Facebook relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Meta Platforms Ireland Limited: EUR 180,000,000
Data Protection Commission (Ireland), IrelandDecision of 31 December 2022Appeal status: under appeal
Instagram relied on 'contract' as the legal basis for behavioural advertising and was not transparent about its legal bases.
- Clearview AI: EUR 20,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 17 October 2022Appeal status: unknown
Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.
- Meta Platforms Ireland Limited: EUR 405,000,000
Data Protection Commission (Ireland), IrelandDecision of 2 September 2022Appeal status: under appeal
Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default.
- Clearview AI, Inc: EUR 20,000,000
Hellenic Data Protection Authority, GreeceDecision of 13 July 2022Appeal status: unknown
Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.
- Google LLC: EUR 10,000,000
Agencia Española de Protección de Datos (AEPD), SpainAnnounced on 18 May 2022Appeal status: unknown
Search and video platform forwarded people's content-removal requests (identity, email, reasons, URLs) to a public third-party database without a legal basis, which frustrated the right to erasure.
Not fully confirmed: AEPD press release of 18 May 2022 (procedure PS/00140/2020). The decision date and the split of the fine between the two infringements are not confirmed.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- IAB Europe: EUR 250,000
Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), BelgiumDecision of 2 February 2022Appeal status: upheld
The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO.
- Grindr LLC: NOK 65,000,000
Datatilsynet (Norwegian Data Protection Authority), NorwayDecision of 13 December 2021Appeal status: upheld
Shared users' data (including the fact of using a gay dating app) with advertising partners without valid consent.
- CAIXABANK, S.A.: EUR 6,000,000
Agencia Española de Protección de Datos (AEPD), SpainDecision of 7 January 2021Appeal status: unknown
Bank relied on invalid consent and its privacy information was unclear when it profiled customers and shared data across its group for commercial purposes.
Not fully confirmed: Operative part of resolution PS/00477/2019 read: EUR 2,000,000 for Articles 13 and 14 and EUR 4,000,000 for Article 6; a charge under Article 22 was dismissed. The resolution text carries no visible date; 7 January 2021 comes from a later AEPD document.
- Google LLC: SEK 75,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 10 March 2020Appeal status: reduced
Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking.
- TIM S.p.A.: EUR 27,802,946
Garante per la protezione dei dati personali, ItalyDecision of 15 January 2020Appeal status: unknown
Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners.
Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete.
- Google LLC: EUR 50,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 21 January 2019Appeal status: upheld
Information on ad personalisation was scattered and unclear, and consent to it was not specific or informed (pre-ticked, bundled), so it gave no valid legal basis.