General Data Protection Regulation Lawfulness of processing
Article 6 of the GDPR sets out the different legal bases under which personal data can be lawfully processed. A common way of acquiring a lawful basis to process personal data under the GDPR is to obtain the consent of the individual to whom the data relates. Consent under the GDPR must be a freely given, specific, informed and unambiguous indication of the individual’s wishes. There must be some form of clear affirmative action. Consent cannot be inferred from silence, pre-ticked boxes or inactivity. Consent must also be separate from other terms and conditions, and it is also a requirement to provide simple ways for people to withdraw consent.
	Persons giving consent need to have a certain level of understanding of what they are being asked which is why the GDPR specifies that parents or guardians must give consent to personal data processing on behalf of young children using information society services. "Information society services" generally include commercial websites. The term is defined as any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services (see Article 1(1)(b) of EU Directive 2015/1535).
	Consent is not the only way to enable processing of personal data. As an alternative to consent, there may be a contractual or other legal obligation that allows data to be processed. Data may also be processed without consent where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
	As with the 1998 Act, data may also be processed where there is a "legitimate interest", although this can no longer be relied upon by public authorities when performing their public tasks. A legitimate interest may include processing for direct marketing purposes or preventing fraud; transmission of personal data within a group of undertakings for internal administrative purposes, including client and employee data processing for the purposes of ensuring network and information security and reporting possible criminal acts or threats to public security to a competent authority.
	Where explicit consent is not obtained, there are additional limitations on when data can be lawfully processed for special categories of personal data and personal data relating to criminal convictions etc.