How to identify your lawful basis for processing personal data

What is it?

A checklist and guidance to help you identify the drivers for your work and the appropriate lawful basis conditions for each of your projects and activities.

Why did we create it?

We’ve created a checklist that people can refer to when they need to establish what allows them to process personal data in their projects and activities. Having a guide allows for officers to self-serve before seeking the help of the Data Protection Officer.

Who should use it?

• Data owners
• Project leads
• Data Protection Officers (to share with their organisation’s staff)

© London Office of Technology and Innovation, 2026. This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

< Deciding how long to keep personal data

Topic-specific resources >