I used Termly's privacy policy generator, and in the policy that they generated there are four Article 6 legal bases:

  • Consent
  • Legitimate Interests
  • Legal Obligations
  • Vital Interests

I took a screenshot of the section that lists the legal bases.

Now, my question is, does Termly's approach work at all? Does it have any legal value? I thought that you can only choose one legal basis at a time.

This is what the ICO has to say about changing the legal basis

You must determine your lawful basis before starting to process personal data. It’s important to get this right first time. If you find at a later date that your chosen basis was actually inappropriate, it will be difficult to simply swap to a different one. Even if a different basis could have applied from the start, retrospectively switching lawful basis is likely to be inherently unfair to the individual and lead to breaches of accountability and transparency requirements.

  • These four points are not exclusive, but are linked to each other. Even if you have legitimate interests and/or legal obligations, consent must be given.
    – PMF
    Oct 10, 2022 at 15:03
  • 4
    @PMF "Even if you have legitimate interests and/or legal obligations, consent must be given" This is not correct. Consent is not required if a different lawful basis applies. Oct 10, 2022 at 15:27
  • True, that was a bit to simplistic. What I meant to say was that in most cases you need to consider all the points some way or other.
    – PMF
    Oct 10, 2022 at 16:39
  • 1
    There often is a consent question, but not in the direct GDPR sense. Even if you process data using one of the other 5 basis, you still need to inform the user up front. And often that means the person can decide not to enter into a contract, if they won't consent. But this is the usual "no contract without mutual consent".
    – MSalters
    Oct 11, 2022 at 11:40
  • 1
    @PaulRazvanBerg: A "privacy notice" is highly unlikely to be a contract (but you have to consider jurisdictions). E.g. in Common Law a privacy notice cannot be a contract because there's no consideration. And in the EU, hiding contract terms behind a label "privacy notice" would fail the "informed" part of "informed consent". Cookie walls in particular are legally problematic.
    – MSalters
    Oct 11, 2022 at 13:24

1 Answer 1


There are two related aspects to this question: can multiple legal bases cover the same processing purpose, and how must this information be presented in the privacy notice?

In the following, this answer will address the following sub-questions, listed here alongside a short summary.

  • Do you need a clear mapping between processing purposes and corresponding legal bases?

    Yes, such a mapping is effectively necessary to satisfy your GDPR obligation to be able to demonstrate that all your processing activities are covered by a legal basis.

  • If one legal basis doesn't work out, can you fall back to a different one?

    No. This is nonsensical considering how the individual legal bases work. However, it is possible that similar processing activities serve different purposes under different legal bases, and it can be worth evaluating different legal bases when trying to determine which one you should rely on.

  • How should legal bases be presented in a privacy notice?

    While a Termly-style generic list of potential legal bases is common, there are good reasons to believe that this fails to achieve the GDPR's transparency goals. It is better to clearly associate each processing purpose with its legal basis.

  • Appendix: positive examples of structuring a privacy notice

Do you need a clear mapping between processing purposes and corresponding legal bases?

Yes, the data controller must always have a clear understanding regarding which processing activity is conducted under which legal basis.

Under Art 5 GDPR, personal data shall only be “collected for specified, explicit and legitimate purposes” and processed “lawfully, fairly and in a transparent manner”. “The controller shall be responsible for, and be able to demonstrate compliance with [these obligations]”. To be able to demonstrate that each processing activity is covered by a legal basis, it is necessary in practice to have a document that spells out the specific legal basis relied upon for each processing purpose. Some data controllers are formally required to maintain such Art 30 Records of Processing Activities (ROPAs), but keeping track of core information makes sense for all data controllers.

The ICO writes in their guide on lawful basis for processing:

You need therefore to keep a record of which basis you are relying on for each processing purpose, and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies. This will help you comply with accountability obligations, and will also help you when writing your privacy notices.

It is your responsibility to ensure that you can demonstrate which lawful basis applies to the particular processing purpose.

If one legal basis doesn't work out, can you fall back to a different one?

Probably not.

Processing for different purposes. In some cases, it will happen that data is processed for one purpose initially, and for another purpose under a different legal basis subsequently. For example, a web shop might collect payment information in order to execute a contract to buy goods. But once that contract is fulfilled, it is likely that the webshop will have to archive some of that information for multiple years due to legal obligations around financial recordkeeping. While in both cases the processing activity is similar (storage of the information), the purpose is different and so the legal basis can differ.

In this context, it is useful to consider Art 6(4), which discusses when data that collected for one purpose can be reused for another purpose. This is possible whenever those purposes are “compatible”.

Multiple legal bases for the same purpose. Some data controllers try to apply multiple legal bases to the same processing purpose, in the hope that some will stick. For example:

  • We're showing personalized ads based on your consent.
  • But if you decline consent we will show you personalized ads because we have a legitimate interest in making money.
  • And if you object to the legitimate interest then showing you personalized ads is necessary for performance of a contract we have with you, namely in section 7(23)(f)(ii)(ξ) of our terms of service where “Service shall make reasonable effort to ensure that Content shown is relevant to User”.

This doesn't work.

  • Specifically in the case of consent, consent can only ever serve as a legal basis if the data subject has an actual choice. If the data controller just falls back to a different legal basis in case consent is declined or withdrawn, that choice is hollow.

  • Similarly, having a fallback for legitimate interests makes no sense. The core aspect of a legitimate interest is that there must be a balancing test between the legitimate interests and the data subject's rights and interests. A legitimate interest can only serve as a legal basis if it outweighs the data subject's interests. A core factor here is whether the data subject can reasonably expect their data to be processed for the given purpose. Data subjects can object to the legitimate interests, which may make it necessary to re-run the balancing test taking into account the objecting data subject's individual circumstances. But it is quite possible that the legitimate interest still overrides the data subject's interests, so that processing can continue. On the other hand if the objection prevails, it is difficult to conceive a scenario where there could exist some fallback legal basis to continue despite the successful objection.

  • Specifically for the issue of using Art 6(1)(b) necessity for performance of a contract instead of other legal bases, the EDPB has published guidelines 2/2019. They explain that whether processing is indeed “necessary” must be considered from the perspective of the data subject, so that many purposes like “service improvement” or advertising cannot be covered by this legal basis. Something does not become truly necessary for a contract just because it was unilaterally inserted into a terms of service document.

Determining an appropriate legal basis. However, thinking in terms of fallbacks can be quite useful for determining an appropriate legal basis. In general, legal obligations or necessity for performance of a contract should be considered first, falling back to a legitimate balancing test otherwise. Consent is a choice of last resort when no other legal basis would apply, since consent can authorize nearly any processing activity, no matter how risky or disadvantageous to the data subject, if the consent was obtained in a valid manner.

How should legal bases be presented in a privacy notice?

The GDPR is slightly ambiguous here. Per Art 13(1)(c), your privacy notice must provide

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing

It is possible to interpret this in two ways:

  • you list the purposes of processing, and separately any legal bases that you may rely on for any purposes; or
  • you list the purposes of processing, and for each purpose you also list which legal bases you rely on for that specific purpose.

Providing an abstract list of legal bases. You very commonly see the first approach, that essentially just summarizes Art 6(1) GDPR for the convenience of the reader. This boilerplate approach is of course attractive for privacy policy generators that do not understand the context your specific processing purposes.

While the relevant EDPB guidelines on transparency don't take a clear stand on this matter, I have doubts that this first approach is fully GDPR compliant.

This fails to provide required transparency. The Art 13 and Art 14 information obligations are an expression of the Art 5 GDPR principles like “lawfulness, fairness and transparency”. Merely listing any potentially applicable legal bases does not make it transparent to the data subject what data is being processed under which rules. But knowing the legal basis covering a particular processing activity has direct impact on the data subject's rights such as the right to revoke consent, to object to legitimate interests, or to erasure.

This fails to specify the actual legal basis. Such a generic listing might also fail to fully satisfy the conditions for certain legal bases.

  • Where the legal basis is a “legal obligation”, it is not sufficient to generically refer to legal obligations in abstract. Rather, Art 6(3) says that

    The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
    (a) Union law; or
    (b) Member State law to which the controller is subject.

    Thus, I would expect a fully compliant privacy notice to actually reference those laws, at least in a general sense (e.g. compliance with court orders, or for financial recordkeeping).

  • Specifically in the case where legitimate interests are used as the legal basis, Art 13(1)(d) says that those legitimate interests shall be provided.

Guidance from the EDPB WhatsApp decision. While the Transparency Guidelines linked above are not excessively helpful here, there is a body of regulatory interpretation for example in the form of the EDPB binding decision 1/2021 regarding WhatsApp. In section 5.1, it is discussed whether the WhatsApp privacy notice at the time satisfied Art 13(1)(d). Here, the EDPB quite unambiguously argues that only the second approach – per-purpose information – can be compliant. From para 56 and 59 in the decision:

The EDPB is of the view, […] that providing full information on each and every processing operation respectively is the only approach that will ensure that the data subjects can:

  • (a) exercise choice as to whether or not they might wish to exercise any of their data subject rights and, if so, which one(s);
  • (b) assess whether or not they satisfy any conditionality associated with the entitlement to exercise a particular right;
  • (c) assess whether or not theyare entitled to have a particular right enforced by the data controller concerned; and
  • (d) assess whether or not they have a ground of complaint such as to be able to meaningfully assess whether or not they wish to exercise their right to lodge a complaint with a supervisory authority.

[…] The EDPB considers that in the Legal Basis Notice WhatsApp IE has not specified the provided information with regard to the corresponding processing operation such as information about what categories of personal data are being processed for which processing pursued under basis of each legitimate interest respectively.

Practical impact. Termly's templates fall short of this standard, but their fine print also makes it clear that their service does not provide legal advice and that they aren't responsible for anything.

It may also be worth considering that your privacy notices will likely face less scrutiny than WhatsApp, as in the decision cited above. That a very strict standard was applied to WhatsApp also has to do with Facebook's/Meta's/WhatsApp's history of playing games around appropriate legal bases and its extremely large user base, also involving children, making it very important to provide clear and comprehensive notices.

Appendix: positive examples of structuring a privacy notice

My suggestion would be to think about these transparency obligations in a tabular manner where you have an Excel sheet with columns for purpose, data involved, retention periods, and legal basis:

purpose data retention legal basis
personalized ads cookie identifiers, interest profile 6 months Art 6(1)(a) consent
server security logs IP address 3 months Art(6)(1)(f) necessary for legitimate interest
showing comments to other users username, comment until you delete the comment Art 6(1)(b) necessary for performing service
... ... ...

Many data controllers will have exactly such information anyway when they keep Art 30 Records of Processing.

Based on these records, it is then possible to write an accurate and understandable privacy notice that clearly relates processing purposes with other required information. I have seen privacy notices that use exactly such a tabular approach, though it's more common to provide a sub-section per purpose. For example:

Purposes for which we process your personal data:

  • Personalized ads. If you give consent (Art 6(1)(a) GDPR), we will show you personalized ads. For this we will set a cookie identifier (→ about cookies), and collect a profile of your interests based on the content that you interact with. The profile will be deleted 6 months after you last interact with our site.

  • ...

  • Showing comments to other users. When you post public comments, we will show them to other users. Providing this service is necessary to perform our contract with you (Art 6(1)(b) GPDR). The comment will publicly display your username, the date when you posted the comment, and the contents of the comment. The comment will be shown indefinitely, but you can delete it at any time (→ help center).

Such an approach also fits well with a “layered approach” to transparency, where you split the information of the privacy notice across multiple pages, so that data subjects only have to read about those processing activities that are relevant to them. For example, an online marketplace company might have different notices covering browsing the listings on their site, buying a product, seller-side activities, and their employee recruiting processes.

Another reasonably good approach I've seen is to have a section per aspect required by the GPDR, and to then provide a list that goes through each processing purpose. This is essentially a flattened version of the above table:

Processing purposes:

  • personalized ads
  • server security logs
  • showing comments to other users

Legal basis for processing purposes:

  • for personalized ads: your consent pursuant to Art 6(1)(a) GDPR
  • for server security logs: our Art 6(1)(f) GDPR legitimate interest in ensuring the security of our services against hacks, DDoS attacks, or other criminal acts
  • for showing comments to other users: Art 6(1)(b) necessity for performing our contract with you: showing comments is a core feature of our website, as covered by our terms of service (→ link).

Which data is processed:

  • for personalized ads: cookie identifiers, interest profile based on the content you interact with
  • for server security logs: your IP address, a timestamp, and which pages you visit on our site
  • for showing comments to other users: your username, date when you posted the comment, and the contents of the comment

How long your data is kept:

  • ...
  • Wow. Thanks for writing such a detailed answer. This is very helpful! Oct 11, 2022 at 7:28
  • I'm not entirely convinced that it's impossible to have multiple bases per purpose (I need to read the explanation here a bit more carefully), but even if it is, it's generally the case AFAIK that a party in a judicial action must put every alternative argument before the court. So if a company chooses one basis in its TOS it may not be able to argue alternatively for another basis, leaving it with no basis whatsoever if the court finds its chosen basis inapplicable. Does this not argue in favor of putting forth alternative bases in the TOS?
    – phoog
    Oct 11, 2022 at 8:49
  • @phoog: No, it doesn't argue in favor of that. That's pretty much the point of this answer. But note the subtle reasoning: you can have multiple purposes, each with their own basis. A court case would argue that you store data D in violation of the GDPR. You put every argument on the table: you store D for purpose P1 with basis B1, but also for purpose P2 and basis B2. And while there are only 6 enumerated basis, there is no enumerated set of purposes.
    – MSalters
    Oct 11, 2022 at 11:52
  • @MSalters so if I claim legitimate interest for a certain purpose in the TOS where in fact I should have claimed legal obligation for that purpose, what happens? Either the processing is unjustified because I've claimed the wrong basis for the given purpose, or it's justified under the right basis for that purpose despite my faulty claim. If the latter were true then claiming a basis is fairly meaningless, and if the former is true then I need to claim all bases that I could imagine a court accepting order to maximize the likelihood that I've claimed the correct basis.
    – phoog
    Oct 11, 2022 at 11:56
  • @phoog: That's a good example to analyze. The purpose of a legal obligation is quite obvious; to obey the law. That cannot be a purpose for a legitimate interest. So, yes, GDPR violation, can't be fixed in the middle of a court case. And if you do claim a legitimate interest basis, you'll need to show the balance of interests (made again before the court case), which would fail when the correct basis for the purpose is in fact a legal obligation.
    – MSalters
    Oct 11, 2022 at 12:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .