1. Section 2: Principles and lawful processing

1.4. 2.4 Applied activity: lawful-basis workshop

UK data protection learning

2.4 Applied activity: lawful-basis workshop

Practise choosing a basis and explaining the decision.

Activity: Select and justify the basis

For each purpose, identify the most likely lawful basis and explain why the processing is necessary. Some cases require more facts before a final decision.

  1. An online retailer uses a customer's delivery address to fulfil an order.
  2. A college records attendance to perform its statutory and educational functions.
  3. A business sends optional promotional emails to people who have clearly opted in.
  4. A security team reviews access logs to detect attacks and protect its network.
  5. A manager wants to publish every employee's date of birth on the intranet because it may improve morale.
  6. An employer records sickness information to manage absence and workplace adjustments.
Open the answer guidance
  • Delivery address: contract is likely to apply because the data is needed to fulfil the order.
  • College attendance: public task or legal obligation may apply, depending on the exact legal function and institution.
  • Optional promotional email: consent may apply, while electronic marketing rules must also be considered.
  • Security logs: legitimate interests may apply where necessity and balancing are properly assessed; other bases may apply to some organisations.
  • Publishing all dates of birth: likely unnecessary and disproportionate. A lawful basis does not remove the need to satisfy the principles.
  • Sickness information: an Article 6 basis plus an Article 9 health-data condition is normally required.

Create a lawful-basis record

For one scenario, produce a short record containing:

  • purpose of processing;
  • categories of personal data;
  • people affected;
  • selected Article 6 basis;
  • necessity explanation;
  • additional condition where required;
  • expected retention period;
  • main safeguards; and
  • review date.

Official reference points

Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.