The seven principles and the six lawful bases

Lesson 2 of 6 in Privacy and Data Protection Law for AI: GDPR from Scratch.

Article 5 states seven principles that everything else in the GDPR elaborates. For AI work, read each as a design constraint:

Lawfulness, fairness, transparency — you need a legal basis, no deceptive processing, and people must be able to understand what happens to their data. Purpose limitation — data collected for one purpose cannot be freely reused for another; "we had it anyway, so we trained on it" is the classic violation. Data minimisation — only data adequate, relevant, and necessary for the purpose; a direct collision with machine learning’s more-data-is-better instinct that regulators resolve in favour of the law, not the loss curve. Accuracy — personal data must be accurate and correctable; the EDPB’s ChatGPT taskforce made clear this applies to model outputs about people, hallucinations included. Storage limitation — no keeping data forever "in case we retrain". Integrity and confidentiality — security proportionate to risk. Accountability — the controller must be able to demonstrate all of the above: records, assessments, documentation. If accountability sounds like ISO 42001 and the AI Act’s technical documentation, that is no accident — GDPR invented the pattern.

Now the question every AI project must answer before it processes a single record: which of Article 6’s six lawful bases covers this processing? No basis, no processing — full stop. The six:

  1. Consent — freely given, specific, informed, unambiguous, and withdrawable as easily as it was given. Powerful but fragile: withdrawal at scale can gut a training corpus, and "consent" extracted through take-it-or-leave-it terms is invalid.
  2. Contract — processing objectively necessary to deliver a contract the data subject is party to. Narrow: necessary means necessary, not useful. Training a general model is almost never "necessary" to deliver your app.
  3. Legal obligation — a law requires exactly this processing (tax records, KYC).
  4. Vital interests — life-or-death situations; rarely relevant to AI.
  5. Public task — official authority or a task in the public interest, grounded in law; for public-sector deployers.
  6. Legitimate interests — the controller’s (or a third party’s) legitimate interest, unless overridden by the data subject’s rights. The flexible basis — and the one carrying nearly the entire weight of commercial AI training.

Legitimate interests is not a rubber stamp. It requires the documented three-part test: a legitimate interest (lawful, real, articulated), necessity (no less intrusive way to achieve it), and balancing (the person’s interests, rights, and reasonable expectations do not override yours). The EDPB’s Opinion 28/2024 confirmed legitimate interests can ground AI training — including web scraping — but pushed hard on the balancing limb: did people reasonably expect their data to be used this way? What mitigations exist (opt-outs honoured, output filters, transparency, excluding sensitive sources)? A failed balancing test has real teeth: it is the ground on which regulators paused Meta’s use of European user posts for AI training in 2024.

Pick the lawful basis for your AI processing

Interactive decision tree — outcomes:

  • Stop — Article 9 blocks this

    Without an Article 9(2) condition, processing special-category data is prohibited. Legitimate interests cannot save it. This is the wall Clearview hit: biometric identifiers scraped without any condition, maximum fines in four countries.

  • Contract — Article 6(1)(b)

    Valid for processing strictly necessary to deliver the service (e.g. processing a prompt to answer it). It does not stretch to model training or product improvement — regulators read "necessary" narrowly.

  • Legal obligation — Article 6(1)(c)

    Sound where a law mandates the processing (fraud reporting, KYC). The obligation must be in law — a business policy or a contract with a partner does not count.

  • Public task — Article 6(1)(e)

    The public-sector basis: official authority or a public-interest task laid down in law. Common for government AI deployments — and it pairs with heightened DPIA and transparency expectations.

  • Consent — Article 6(1)(a)

    Workable when the choice is real. Remember the operational cost: consent must be as easy to withdraw as to give, and withdrawal means stopping the processing — hard when the data is already inside a trained model. Design for deletion before you rely on consent.

  • Legitimate interests — Article 6(1)(f)

    The workhorse of commercial AI training, per EDPB Opinion 28/2024 — but only with the three-part test documented (an LIA), mitigations in place, and no special-category data. Expect regulators to ask for the assessment, not your assurances.

  • No basis fits — redesign the processing

    This is the GDPR working as intended: minimise the data, anonymise properly, narrow the purpose, or do not build it. Proceeding without a basis is how training programs end up suspended mid-flight.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.