What Is a Lawful Basis for Processing?

What are the six lawful bases?

Consent. The person has given clear, affirmative agreement to a specific purpose. It must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

Contract. Processing is necessary to perform a contract with the person, or to take steps at their request before entering one. Fulfilling an order relies on this.

Legal obligation. Processing is necessary to comply with the law. Retaining financial records for a statutory period sits here.

Vital interests. Processing is necessary to protect someone's life. Rare outside emergency and healthcare contexts.

Public task. Processing is necessary to perform a task in the public interest or under official authority. Mostly public bodies.

Legitimate interests. Processing is necessary for interests pursued by you or a third party, except where those interests are overridden by the individual's rights and freedoms. The most flexible basis and the one requiring the most work to rely on properly.

Why is consent often the wrong choice for CRM?

Four reasons, and they compound.

It can be withdrawn at any time. When it is, the processing must stop. If your customer service operation depends on consent, a withdrawal means you can no longer service that person, which is usually not the outcome anyone intended.

It must be freely given. If the person has no genuine choice, or cannot decline without detriment, consent is not valid. This is why consent is generally a poor basis in an employment context, where the power imbalance undermines it.

It must be specific. Consent to one purpose does not cover a second purpose bolted on later.

It is harder to evidence than people expect. You must be able to show who consented, when, to what, and how. A ticked box with no record of the wording shown at the time is weak evidence.

Consent is the right basis where the person genuinely has a free choice and the processing is genuinely optional, which describes marketing communications well and describes core CRM operations badly.

When do legitimate interests apply?

Legitimate interests is often the better fit for ordinary business processing, and it carries an obligation: you have to do and document a balancing exercise, commonly called a Legitimate Interests Assessment.

Three tests:

• Purpose. Is there a legitimate interest behind the processing? • Necessity. Is the processing necessary to achieve it, or could you achieve the same result less intrusively? • Balancing. Do the individual's interests, rights and freedoms override yours?

If the balancing test fails, you cannot rely on this basis. If it passes, document the reasoning, because the assessment is the evidence.

Note the trade: relying on legitimate interests gives the individual an unqualified right to object to direct marketing, and a qualified right to object to other processing.

Does the basis change which rights apply?

Yes, and this is the practical reason to choose carefully rather than defaulting.

A team that defaults everything to consent has, without meaning to, granted the widest set of rights and made its own operations the most fragile.

Can I change the lawful basis later?

Not casually, and not because the original became inconvenient.

You must determine the basis before processing starts and inform people of it under Article 13. Switching later, particularly from consent to legitimate interests after consents start being withdrawn, is the specific pattern regulators treat as bad faith.

If circumstances genuinely change, the honest route is to reassess, document the new basis, and tell the individuals. It is not a silent field update.

What about special category data?

Article 9 data, which covers health, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life and sexual orientation, is prohibited by default.

To process it lawfully you need both an Article 6 lawful basis and a separate Article 9(2) condition, such as explicit consent, employment and social security law, or substantial public interest.

This surfaces in a CRM more often than teams expect, usually through a custom field created for a specific programme or through free-text case notes where an agent recorded something a customer volunteered.

What does this mean in Salesforce?

Lawful basis is a legal determination, not a feature. What the platform has to do is make the determination operational.

Record it per purpose. The basis attaches to a processing purpose, not to a contact record. Marketing communications, service delivery and billing may each rely on a different one for the same person.

Honour withdrawal and objection everywhere. If a consent is withdrawn or an objection upheld, every downstream process that reads the record has to respect it, including campaigns, integrations, data shares and AI features grounded on CRM data. Consent Management makes that state a first-class field rather than a checkbox convention only the marketing team knows about.

Be able to evidence it. Who consented, when, to what wording, through which channel. Under Article 5(2) you have to demonstrate compliance, not just achieve it.

Find the special category data you did not plan for. Personal Data Discovery scans standard and custom objects, which is how Article 9 data in an unexpected field gets found before a regulator finds it.

To be clear about what software cannot do here: choosing the lawful basis is a legal determination, and no product makes it for you. A tool can record which basis you selected, evidence when consent was captured, and enforce a withdrawal everywhere it needs to reach. Deciding whether legitimate interests survives the balancing test is counsel's work, not a configuration setting.