§ GDPR · Article 6

GDPR Article 6: Obligations, Deadlines & Penalties

Regulation (EU) 2016/679, Article 6 · All obligations · GDPR

At a glance

Article 6 of the GDPR imposes 4 obligations on Member States, Union or Member State, controller.

§ Obligations

All obligations under Article 6

Obligation 1

Processing of personal data shall be lawful only if and to the extent that at least one of the specified conditions applies, such as consent, contract performance, legal obligation, vital interests, public interest, or legitimate interests. Regulation (EU) 2016/679, Article 6, Article 6

Obligated entity: controller
Action required: ensure lawfulness
Deadline: —
Penalty: —

Obligation 2

Member States may maintain or introduce more specific provisions to adapt the application of rules regarding processing for compliance with legal obligations or public interest tasks, determining specific requirements to ensure lawful and fair processing. Regulation (EU) 2016/679, Article 6, Article 6

Obligated entity: Member States
Action required: legislate
Deadline: —
Penalty: —

Obligation 3

The legal basis for processing under points (c) and (e) of paragraph 1 shall be laid down by Union law or Member State law, which must determine the purpose and may contain specific provisions on data types, subjects, disclosure, storage, and procedures. Regulation (EU) 2016/679, Article 6, Article 6

Obligated entity: Union or Member State
Action required: establish legal basis
Deadline: —
Penalty: —

Obligation 4

Where processing for a new purpose is not based on consent or specific law, the controller shall take into account specific factors, such as the link between purposes, context, nature of data, consequences, and safeguards, to ascertain compatibility with the initial purpose. Regulation (EU) 2016/679, Article 6, Article 6

Obligated entity: controller
Action required: assess compatibility
Deadline: —
Penalty: —

§ Frequently asked

Questions about Article 6

Who must comply with Article 6 of the GDPR? +

Member States, Union or Member State, controller.

What does Article 6 of the GDPR require? +

ensure lawfulness legislate establish legal basis

Need a cross-border briefing on GDPR Article 6?

Search Fontvera ↵

All EU obligation pages · All GDPR articles