Legal obligation

At a glance

• You can rely on this lawful basis if you need to process the personal data to comply with a common law or statutory obligation.
• This does not apply to contractual obligations.
• The processing must be necessary. If you can reasonably comply without processing the personal data, this basis does not apply.
• You should document your decision to rely on this lawful basis and ensure that you can justify your reasoning.
• You should be able to either identify the specific legal provision or an appropriate source of advice or guidance that clearly sets out your obligation.

In brief

• What does the UK GDPR say?
• When is the lawful basis for legal obligations likely to apply?
• When is processing ‘necessary’ for compliance?
• What else should we consider?

What does the UK GDPR say? 

Article 6(1)(c) provides a lawful basis for processing where:

“processing is necessary for compliance with a legal obligation to which the controller is subject.”

When is the lawful basis for legal obligations likely to apply?

In short, when you are obliged to process the personal data to comply with the law.

Article 6(3) requires that the legal obligation must be laid down by UK law. Recital 41 confirms that this does not have to be an explicit statutory obligation, as long as the application of the law is foreseeable to those individuals subject to it. So it includes clear common law obligations.

This does not mean that there must be a legal obligation specifically requiring the specific processing activity. The point is that your overall purpose must be to comply with a legal obligation which has a sufficiently clear basis in either common law or statute.

You should be able to identify the obligation in question, either by reference to the specific legal provision or else by pointing to an appropriate source of advice or guidance that sets it out clearly. For example, you can refer to a government website or to industry guidance that explains generally applicable legal obligations.

Regulatory requirements also qualify as a legal obligation for these purposes where there is a statutory basis underpinning the regulatory regime and which requires regulated organisations to comply.

A contractual obligation does not comprise a legal obligation in this context. You cannot contract out of the requirement for a lawful basis. However, you can look for a different lawful basis. If the contract is with the individual you can consider the lawful basis for contracts. For contracts with other parties, you may want to consider legitimate interests.

When is processing ‘necessary’ for compliance?

Although the processing need not be essential for you to comply with the legal obligation, it must be a reasonable and proportionate way of achieving compliance. You cannot rely on this lawful basis if you have discretion over whether to process the personal data, or if there is another reasonable way to comply.

It is likely to be clear from the law in question whether the processing is actually necessary for compliance.

What else should we consider?

If you are processing on the basis of legal obligation, the individual has no right to erasure, right to data portability, or right to object. Read our guidance on individual rights for more information.

Remember to:

• document your decision that processing is necessary for compliance with a legal obligation;
• identify an appropriate source for the obligation in question; and
• include information about your purposes and lawful basis in your privacy notice.