Lawful basis

The guidance on this page is suitable for large businesses in the public, private and third sectors. Small businesses should use the resources in our section containing advice for small organisations.

Brief guidance 

A guide to lawful basis for using information

Guidance on the six reasons you can use for using personal information (known as lawful basis), how you can decide the right one for you, and the extra rules for more sensitive types of information (including special category and criminal offence data).

Detailed guidance 

Consent 

When you can (and can't) use consent, why it's important, and how to obtain, record and manage consent.

Legitimate interest 

When you can use legitimate interests and how to apply it.

Special category data

What is special category data, what are the rules about using it and what are the extra conditions you need to meet.

Criminal offence data

What is criminal offence data, what are the rules for using it and what are extra conditions you need to meet.

Biometric data guidance: Biometric recognition

What is biometric data, what is meant by "biometric recognition", demonstrating compliance with data protection obligations and processing biometric data fairly and lawfully.

In your sector

The lawful basis for the processing of vehicle keeper data by the Driver and Vehicle Licensing Agency (DVLA)

Commissioner’s Opinion primarily for the DVLA and the Department of Transport. It sets out the correct lawful basis for the DVLA to process vehicle keeper data when sharing it with car park management companies to recover unpaid parking charges.

Resources 

Lawful basis interactive toolkit 

Answer questions to help decide the lawful basis you can use.

Training videos: handling more sensitive information

Recordings of ICO staff training special category and criminal offence data.