Skip to content

This term

Lawful Basis

The legal ground that permits processing personal data: one of GDPR's six bases, or consent or a specified legitimate use under India's DPDP Act.

Also called: Lawful basis for processing · Legal basis for processing · Lawful ground · Grounds for processing

Often confused with

General Data Protection Regulation

The EU's data protection law. It also applies to an Indian business that offers goods or services to people in the EU or monitors them, including on WhatsApp.

Read the General Data Protection Regulation entry

Find the lawful basis for a WhatsApp message

Question 1 · up to 2

Whose data is it?

Your answers

None yet — pick an answer to start down the tree.

Path map

Depth 0 of up to 2. Circles are questions, squares are outcomes.

All possible outcomes (7)

  • Contract, Article 6(1)(b)

    Messages needed to deliver what the customer asked for. No consent or objection handling, but keep them free of promotions.

    Path: “People in the EU (GDPR)” → “An order or booking they asked for”

  • Consent, Article 6(1)(a)

    Prior, specific, recorded consent, as easy to withdraw as to give. An objection to marketing must stop it at once.

    Path: “People in the EU (GDPR)” → “Marketing or promotions”

  • Legitimate interests, Article 6(1)(f)

    Allowed after a written balancing test. People can object, and you must stop unless you show compelling grounds.

    Path: “People in the EU (GDPR)” → “Fraud checks or chat analytics”

  • Legal obligation, Article 6(1)(c)

    Only where a specific law requires the processing; name that law in your records.

    Path: “People in the EU (GDPR)” → “A message a law requires”

  • Legitimate use, section 7(a)

    Use the number only for the purpose it was given for, and stop if they object. Marketing on it still needs consent.

    Path: “People in India (DPDP Act)” → “Yes, e.g. order updates after checkout”

  • Consent, section 6

    A notice first, then a clear affirmative action. Withdrawal must be as easy, and you must be able to prove both.

    Path: “People in India (DPDP Act)” → “No, or it is marketing”

  • Legitimate use, section 7(d) or 7(e)

    Covers complying with a court order or a legal duty to disclose information to the State; it rarely covers routine customer messages.

    Path: “People in India (DPDP Act)” → “A court order or a duty to disclose to the State”

Answer two questions about a message, whose data it is and what it is for, to reach the usual basis under GDPR or the DPDP Act and what that basis requires of you.

Question 1: Whose data is it? 2 options.

What is a lawful basis?

A lawful basis is the legal justification for processing personal data for a particular purpose. Data protection laws do not only ask whether data is kept safely; they first ask whether the business may use it at all, for that purpose. Each purpose (sending an order update, a marketing broadcast, a login code, analysing support chats) needs its own basis, chosen before the processing starts and recorded so it can be shown later.

GDPR lists six in Article 6(1): consent; performance of a contract with the person; compliance with a legal obligation; protecting someone's vital interests; a task carried out in the public interest or in official authority; and legitimate interests, which need a balancing test against the person's rights. Special categories such as health data need an additional condition under Article 9. Consent must be freely given, specific, informed and unambiguous, and the controller must be able to prove it.

India's DPDP Act is narrower. Section 4 allows processing only with consent or for one of the certain legitimate uses in section 7: data a person voluntarily provided for a specified purpose without objecting, certain state functions and benefits, legal duties to disclose information to the State, court orders, medical emergencies, epidemics and disasters, and employment. There is no open-ended legitimate-interests ground, so uses a GDPR team would justify with a balancing test usually need consent in India.

A lawful basis is a broader idea than an opt-in, which is only the consent route seen from the messaging side. A business messaging both Indians and Europeans often maps the same WhatsApp purpose to two different bases: a booking confirmation rests on contract under GDPR and on a voluntarily provided number under section 7(a) of the DPDP Act.

Key takeaways

  • A lawful basis is the legal ground for one specific use of personal data; without one, processing is unlawful however well it is secured.
  • GDPR offers six bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.
  • The DPDP Act offers only consent or a listed legitimate use; there is no general legitimate-interests ground.
  • On WhatsApp, order updates usually rest on contract or a legitimate use, while marketing rests on consent in both regimes.
  • Choose and record the basis per purpose before you start; switching bases afterwards is hard to justify.

Why the difference matters

Why does a lawful basis matter?

Picking the wrong basis is a compliance failure that no amount of encryption fixes, and it is easy to get wrong on WhatsApp, where transactional and promotional messages travel on the same number. A clear basis per message type tells the team which messages need an opt-in, which rights apply (an objection to marketing must stop it at once), and what the notice must say. It is also the first thing a regulator or the Data Protection Board will ask for.

A lawful basis: key facts and limits

GDPR bases
Six, Article 6(1)(a) to (f)
DPDP Act grounds
Consent (s.6) or certain legitimate uses (s.7)
Legitimate interests
GDPR only, after a balancing test
Special categories
GDPR Article 9 adds conditions (e.g. health data)
Marketing messages
Consent, in both regimes
Burden of proof for consent
On the business (GDPR Art. 7(1); DPDP s.6(10))

How does a lawful basis work?

  1. Step 1

    List the purposes

    Order and delivery updates, support replies, OTPs, marketing broadcasts, chat analytics, sharing data with a CRM: one row for each.

  2. Step 2

    Identify whose data, and which law

    People in the EU bring GDPR; people in India bring the DPDP Act. Many businesses need both columns for the same purpose.

  3. Step 3

    Pick the basis per purpose

    Contract or section 7(a) for what the customer asked for; consent for marketing; legal obligation only where a law requires the processing; legitimate interests only under GDPR, with a written assessment.

  4. Step 4

    Match the notice and the rights

    Consent needs a notice and an easy withdrawal; legitimate interests needs an objection route; contract needs neither consent nor objection handling, but still needs transparency.

  5. Step 5

    Record it

    Keep the basis and the reasoning for each purpose and, for consent, a consent record with timestamp and wording. Do not swap bases after the fact.

Example: One number, two laws, in Goa

A Goa homestay chain messages Indian and European guests from the same WhatsApp number. Booking confirmations and check-in instructions rest on contract for EU guests and on section 7(a) for Indian guests, who gave their numbers to receive them. Its off-season offers list needs consent from both groups, collected with an unticked box. A review found its support-chat analysis relied on legitimate interests: workable for EU guests with a documented assessment, but with no clear equivalent under the DPDP Act, so Indian guests' transcripts are now excluded unless the guest consents.

Common mix-ups

Common mistakes with a lawful basis

  • Using consent for everything

    If the customer cannot refuse without losing the service, as with order updates, consent is not freely given. Use contract or section 7(a), and keep consent for optional uses such as marketing.

  • Importing legitimate interests into India

    The DPDP Act has no balancing-test ground. Re-map every GDPR legitimate-interests purpose to consent or a section 7 use before applying it to Indian contacts.

  • Switching bases when consent is withdrawn

    If a purpose relied on consent and the person withdraws, you cannot carry on under legitimate interests for the same purpose. Stop, and suppress the number.

  • Mixing purposes in one message

    An order update with a promotional banner is partly marketing, and Meta treats mixed content as marketing too. Keep transactional messages free of offers so each keeps its own basis.

Lawful Basis FAQs

What lawful basis do I need for WhatsApp marketing?+
Consent, in both the EU and India. The ePrivacy rules that sit alongside GDPR generally require prior consent for electronic marketing, and the DPDP Act has no legitimate-interests ground that could replace it.
Can I send order updates on WhatsApp without consent?+
Usually, yes. Under GDPR they rest on the contract; under the DPDP Act, section 7(a) covers a number the customer gave for that purpose, as long as they have not objected.
Does the DPDP Act have legitimate interests like GDPR?+
No. It allows consent or a closed list of legitimate uses in section 7, such as voluntarily provided data, court orders and medical emergencies; there is no open balancing test.
Can I change the lawful basis later?+
Rarely, and never to escape a withdrawal. Choose the basis before processing starts; swapping consent for legitimate interests after someone withdraws is treated as unfair under GDPR.

Rules of thumb

Best practices for a lawful basis

  • Keep a one-page register: purpose, data, GDPR basis, DPDP ground, notice wording and retention.
  • Write legitimate-interests assessments before processing starts, not after a complaint.
  • Separate transactional and promotional templates so each message type maps to one basis.

See InfiQ pricing

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms