There are two related aspects to this question: can multiple legal bases cover the same processing purpose, and how must this information be presented in the privacy notice?
In the following, this answer will address the following sub-questions, listed here alongside a short summary.
Do you need a clear mapping between processing purposes and corresponding legal bases?
Yes, such a mapping is effectively necessary to satisfy your GDPR obligation to be able to demonstrate that all your processing activities are covered by a legal basis.
If one legal basis doesn't work out, can you fall back to a different one?
No. This is nonsensical considering how the individual legal bases work. However, it is possible that similar processing activities serve different purposes under different legal bases, and it can be worth evaluating different legal bases when trying to determine which one you should rely on.
How should legal bases be presented in a privacy notice?
While a Termly-style generic list of potential legal bases is common, there are good reasons to believe that this fails to achieve the GDPR's transparency goals. It is better to clearly associate each processing purpose with its legal basis.
Appendix: positive examples of structuring a privacy notice
Do you need a clear mapping between processing purposes and corresponding legal bases?
Yes, the data controller must always have a clear understanding regarding which processing activity is conducted under which legal basis.
Under Art 5 GDPR, personal data shall only be “collected for specified, explicit and legitimate purposes” and processed “lawfully, fairly and in a transparent manner”. “The controller shall be responsible for, and be able to demonstrate compliance with [these obligations]”. To be able to demonstrate that each processing activity is covered by a legal basis, it is necessary in practice to have a document that spells out the specific legal basis relied upon for each processing purpose. Some data controllers are formally required to maintain such Art 30 Records of Processing Activities (ROPAs), but keeping track of core information makes sense for all data controllers.
The ICO writes in their guide on lawful basis for processing:
You need therefore to keep a record of which basis you are relying on for each processing purpose, and a justification for why you believe it applies. There is no standard form for this, as long as you ensure that what you record is sufficient to demonstrate that a lawful basis applies. This will help you comply with accountability obligations, and will also help you when writing your privacy notices.
It is your responsibility to ensure that you can demonstrate which lawful basis applies to the particular processing purpose.
If one legal basis doesn't work out, can you fall back to a different one?
Probably not.
Processing for different purposes.
In some cases, it will happen that data is processed for one purpose initially, and for another purpose under a different legal basis subsequently. For example, a web shop might collect payment information in order to execute a contract to buy goods. But once that contract is fulfilled, it is likely that the webshop will have to archive some of that information for multiple years due to legal obligations around financial recordkeeping. While in both cases the processing activity is similar (storage of the information), the purpose is different and so the legal basis can differ.
In this context, it is useful to consider Art 6(4), which discusses when data that collected for one purpose can be reused for another purpose. This is possible whenever those purposes are “compatible”.
Multiple legal bases for the same purpose.
Some data controllers try to apply multiple legal bases to the same processing purpose, in the hope that some will stick. For example:
- We're showing personalized ads based on your consent.
- But if you decline consent we will show you personalized ads because we have a legitimate interest in making money.
- And if you object to the legitimate interest then showing you personalized ads is necessary for performance of a contract we have with you, namely in section 7(23)(f)(ii)(ξ) of our terms of service where “Service shall make reasonable effort to ensure that Content shown is relevant to User”.
This doesn't work.
Specifically in the case of consent, consent can only ever serve as a legal basis if the data subject has an actual choice. If the data controller just falls back to a different legal basis in case consent is declined or withdrawn, that choice is hollow.
Similarly, having a fallback for legitimate interests makes no sense. The core aspect of a legitimate interest is that there must be a balancing test between the legitimate interests and the data subject's rights and interests. A legitimate interest can only serve as a legal basis if it outweighs the data subject's interests. A core factor here is whether the data subject can reasonably expect their data to be processed for the given purpose. Data subjects can object to the legitimate interests, which may make it necessary to re-run the balancing test taking into account the objecting data subject's individual circumstances. But it is quite possible that the legitimate interest still overrides the data subject's interests, so that processing can continue. On the other hand if the objection prevails, it is difficult to conceive a scenario where there could exist some fallback legal basis to continue despite the successful objection.
Specifically for the issue of using Art 6(1)(b) necessity for performance of a contract instead of other legal bases, the EDPB has published guidelines 2/2019. They explain that whether processing is indeed “necessary” must be considered from the perspective of the data subject, so that many purposes like “service improvement” or advertising cannot be covered by this legal basis. Something does not become truly necessary for a contract just because it was unilaterally inserted into a terms of service document.
Determining an appropriate legal basis.
However, thinking in terms of fallbacks can be quite useful for determining an appropriate legal basis. In general, legal obligations or necessity for performance of a contract should be considered first, falling back to a legitimate balancing test otherwise. Consent is a choice of last resort when no other legal basis would apply, since consent can authorize nearly any processing activity, no matter how risky or disadvantageous to the data subject, if the consent was obtained in a valid manner.
How should legal bases be presented in a privacy notice?
The GDPR is slightly ambiguous here. Per Art 13(1)(c), your privacy notice must provide
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing
It is possible to interpret this in two ways:
- you list the purposes of processing, and separately any legal bases that you may rely on for any purposes; or
- you list the purposes of processing, and for each purpose you also list which legal bases you rely on for that specific purpose.
Providing an abstract list of legal bases.
You very commonly see the first approach, that essentially just summarizes Art 6(1) GDPR for the convenience of the reader. This boilerplate approach is of course attractive for privacy policy generators that do not understand the context your specific processing purposes.
While the relevant EDPB guidelines on transparency don't take a clear stand on this matter,
I have doubts that this first approach is fully GDPR compliant.
This fails to provide required transparency.
The Art 13 and Art 14 information obligations are an expression of the Art 5 GDPR principles like “lawfulness, fairness and transparency”. Merely listing any potentially applicable legal bases does not make it transparent to the data subject what data is being processed under which rules. But knowing the legal basis covering a particular processing activity has direct impact on the data subject's rights such as the right to revoke consent, to object to legitimate interests, or to erasure.
This fails to specify the actual legal basis.
Such a generic listing might also fail to fully satisfy the conditions for certain legal bases.
Where the legal basis is a “legal obligation”, it is not sufficient to generically refer to legal obligations in abstract. Rather, Art 6(3) says that
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
(a) Union law; or
(b) Member State law to which the controller is subject.
Thus, I would expect a fully compliant privacy notice to actually reference those laws, at least in a general sense (e.g. compliance with court orders, or for financial recordkeeping).
Specifically in the case where legitimate interests are used as the legal basis, Art 13(1)(d) says that those legitimate interests shall be provided.
Guidance from the EDPB WhatsApp decision.
While the Transparency Guidelines linked above are not excessively helpful here, there is a body of regulatory interpretation for example in the form of the EDPB binding decision 1/2021 regarding WhatsApp. In section 5.1, it is discussed whether the WhatsApp privacy notice at the time satisfied Art 13(1)(d). Here, the EDPB quite unambiguously argues that only the second approach – per-purpose information – can be compliant. From para 56 and 59 in the decision:
The EDPB is of the view, […] that providing full information on each and
every processing operation respectively is the only approach that will ensure that the data subjects
can:
- (a) exercise choice as to whether or not they might wish to exercise any of their data subject rights and, if so, which one(s);
- (b) assess whether or not they satisfy any conditionality associated with the entitlement to exercise a particular right;
- (c) assess whether or not theyare entitled to have a particular right enforced by the data controller concerned; and
- (d) assess whether or not they have a ground of complaint such as to be able to meaningfully assess whether or not they wish to exercise their right to lodge a complaint with a supervisory authority.
[…] The EDPB considers that in the Legal Basis Notice WhatsApp IE has not specified the provided information with regard to the corresponding processing operation such as information about what categories of personal data are being processed for which processing pursued under basis of each legitimate interest respectively.
Practical impact.
Termly's templates fall short of this standard, but their fine print also makes it clear that their service does not provide legal advice and that they aren't responsible for anything.
It may also be worth considering that your privacy notices will likely face less scrutiny than WhatsApp, as in the decision cited above. That a very strict standard was applied to WhatsApp also has to do with Facebook's/Meta's/WhatsApp's history of playing games around appropriate legal bases and its extremely large user base, also involving children, making it very important to provide clear and comprehensive notices.
Appendix: positive examples of structuring a privacy notice
My suggestion would be to think about these transparency obligations in a tabular manner where you have an Excel sheet with columns for purpose, data involved, retention periods, and legal basis:
| purpose |
data |
retention |
legal basis |
| personalized ads |
cookie identifiers, interest profile |
6 months |
Art 6(1)(a) consent |
| server security logs |
IP address |
3 months |
Art(6)(1)(f) necessary for legitimate interest |
| showing comments to other users |
username, comment |
until you delete the comment |
Art 6(1)(b) necessary for performing service |
| ... |
... |
... |
|
Many data controllers will have exactly such information anyway when they keep Art 30 Records of Processing.
Based on these records, it is then possible to write an accurate and understandable privacy notice that clearly relates processing purposes with other required information. I have seen privacy notices that use exactly such a tabular approach, though it's more common to provide a sub-section per purpose. For example:
Purposes for which we process your personal data:
Personalized ads. If you give consent (Art 6(1)(a) GDPR), we will show you personalized ads. For this we will set a cookie identifier (→ about cookies), and collect a profile of your interests based on the content that you interact with. The profile will be deleted 6 months after you last interact with our site.
...
Showing comments to other users. When you post public comments, we will show them to other users. Providing this service is necessary to perform our contract with you (Art 6(1)(b) GPDR). The comment will publicly display your username, the date when you posted the comment, and the contents of the comment. The comment will be shown indefinitely, but you can delete it at any time (→ help center).
Such an approach also fits well with a “layered approach” to transparency, where you split the information of the privacy notice across multiple pages, so that data subjects only have to read about those processing activities that are relevant to them. For example, an online marketplace company might have different notices covering browsing the listings on their site, buying a product, seller-side activities, and their employee recruiting processes.
Another reasonably good approach I've seen is to have a section per aspect required by the GPDR, and to then provide a list that goes through each processing purpose. This is essentially a flattened version of the above table:
Processing purposes:
- personalized ads
- server security logs
- showing comments to other users
Legal basis for processing purposes:
- for personalized ads: your consent pursuant to Art 6(1)(a) GDPR
- for server security logs: our Art 6(1)(f) GDPR legitimate interest in ensuring the security of our services against hacks, DDoS attacks, or other criminal acts
- for showing comments to other users: Art 6(1)(b) necessity for performing our contract with you: showing comments is a core feature of our website, as covered by our terms of service (→ link).
Which data is processed:
- for personalized ads: cookie identifiers, interest profile based on the content you interact with
- for server security logs: your IP address, a timestamp, and which pages you visit on our site
- for showing comments to other users: your username, date when you posted the comment, and the contents of the comment
How long your data is kept:
