Lawful basis
The GDPR Article 6 requirement that every processing activity rest on one of a defined set of legal grounds (consent, contract, legitimate interest, and others), recorded alongside an access purpose so an access log can demonstrate not only why access occurred but that the underlying processing was legally justified.
Defined in 2 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The GDPR Article 6 requirement that every processing activity rest on one of a defined set of legal grounds (consent, contract, legitimate interest, and others), recorded alongside an access purpose so an access log can demonstrate not only why access occurred but that the underlying processing was legally justified.
The legal ground a controller relies on to process personal data (for example consent, legitimate interest, or contract under the GDPR). A vendor's "compliant" claim is only meaningful if it names a lawful basis you can assess for your intended use, not just for the original collection.
Under GDPR Article 6, the specific legal ground (consent, contract, legitimate interest, legal obligation, vital interest, or public task) that permits processing personal data at all; a separate requirement from purpose limitation.
One of the six legal justifications listed in GDPR Article 6(1) that must apply, per processing purpose, before personal data may be processed at all. Processing without a valid lawful basis is unlawful regardless of whether it is documented, disclosed, or well-intentioned.
The legal ground on which data is processed (for example consent, contract, legal obligation, or legitimate interest). Retention is only lawful while a valid basis persists; when the basis collapses, the data usually must be destroyed.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Purpose archaeology: what your data was collected FOR versus what it feeds now · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Lawful basis, spelled out: consent, contract, legitimate interest, and which one actually covers each dataset · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Row, column, and purpose: access that follows the data's sensitivity, not the org chart · Access and the Keys, Certified AI Data Governance Professional (CADGP)
- The retention decision: what you must keep, what you must destroy, and proving both · Data Reality, Certified AI Governance Professional (CAIGP)
- Third-party data and the vendor claims you must verify yourself · Data Reality, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where Lawful basis starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Classifies information, applies least privilege, sets retention and acceptable-use rules, and controls what may enter a prompt, a log or an embedding.
2 lessons on this page teach it as a primary outcome.
Traces where data came from, what transformed it, who owns each hop and where it flows downstream, so a number can be defended.
2 lessons on this page teach it as a primary outcome.
Applies GDPR, CCPA and sector rules to training data, inference, automated decisions, lawful basis, individual rights and cross-border transfer.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Data Governance Leadneeds it at depth · 2 open postings this week
- Privacy Analystneeds working knowledge
- Chief Data Officer, data leadership editionneeds it at depth
- Chief Privacy Officer, AI privacy editionneeds it at depth
- Chief Information Officer, technology leadership editionneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: ISO/IEC 27001; GDPR Article 5; EU AI Act Article 10; NIST AI RMF MAP 4.
One interview question about it
How do you decide who may access which data for AI work, and how long it is kept?
Asked of candidates for data classification, access and retention. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as a claim to back up: Classification and retention rules are familiar territory.
- Cybersecurity and IT carries it as work you can show: Access governance and classification are implemented, not described.
- Human resources and people operations carries it as a claim to back up: Access restriction and retention for personnel data are routine.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.