Legal basis
A legal basis is one of the conditions listed in a data protection law that makes processing personal data lawful, such as consent, a contract, a legal obligation or legitimate interest.Article 6(1) of the GDPR lists six: consent, performance of a contract, a legal obligation, vital interests, a public task, and legitimate interests. Every processing operation needs one, chosen before the processing starts and named in the privacy notice; switching basis afterwards is not allowed. Special categories of data (health, religion, biometrics and others) need an additional condition from Article 9.
Other laws have their own lists. Brazil's LGPD has ten in Article 7, including credit protection and health protection; the UK GDPR mirrors the EU's six; South Africa's POPIA has six grounds in section 11; Türkiye's KVKK makes explicit consent the default with exceptions in Article 5(2). US state laws do not use the concept and regulate purposes and opt-outs instead.
Cookies involve two layers. The storage or reading of the cookie is governed by the ePrivacy Directive, where the only basis is consent unless the cookie is strictly necessary. The processing of the data collected through the cookie then needs a GDPR basis, and when the cookie required consent, that consent is also the basis for the processing; the EDPB task force confirmed that an unlawful cookie cannot lead to lawful processing. A website's cookie policy should therefore state the basis per category: exempt and necessary for the contract or legitimate interest, consent for analytics and marketing.