Article 6Lawfulness of processing

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Open the article on EUR-Lex

Other articles in this chapter

• 5
• 7
• 8
• 9
• 10
• 11

Related articles

Articles in other acts connected to this one, with the reason written against the text. The map is a route between acts, not an assessment.

• Depends on · incomingePrivacy · 5

  The protection of confidentiality of communications rests on a consent whose meaning is taken from the data protection regulation, which also carries the other bases.

  CELEX 32002L0058 · 2026-08-18

Decisions applying this article

Court, citation and the paragraphs of the reasons where the article is dealt with.

• C-252/21 · Meta Platforms med flera mot Bundeskartellamt2023-07-04

  Court of Justice of the European Union

  Whether a competition authority may examine data protection questions, and on what basis data from third-party sources may be processed.

  Paragraphs 104, 126, 154

Risk, sanction and outcome

Judgments of the Court of Justice

6 decisions

• C-710/23Court of Justice of the European Union2025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  Ask NovaCopilot
• C-394/23Court of Justice of the European Union2025-01-09

  Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object.

  Ask NovaCopilot
• C-65/23Court of Justice of the European Union2024-12-19

  MK v K GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

  Ask NovaCopilot
• C-621/22Court of Justice of the European Union2024-10-04

  Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Lawfulness of processing – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party – Concept of ‘legitimate interests’ – Commercial interest – Sports federation – Disclosure, for consideration, of the personal data of the members of a sports federation to sponsors without the consent of those members.

  Ask NovaCopilot
• C-740/22Court of Justice of the European Union2024-03-07

  Endemol Shine Finland Oy

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ – National legislation governing access to those data – Reconciliation between the right of public access to official documents and the protection of personal data.

  Ask NovaCopilot
• C-667/21Court of Justice of the European Union2023-12-21

  ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning health – Assessment of an employee’s working capacity – Health insurance medical service processing data concerning the health of its own employees – Conditions for such processing and whether permissible – Article 82(1) – Right to compensation and liability – Compensation for non-material damage – Compensatory function – Impact of negligence on the part of the data controller.

  Ask NovaCopilot

Judgments applying this article

62 judgments in the register cite the article in their text. SE 3 · EU 43 · DE 16

• eu:c-252-21
• eu:c-484-24-62024cj0484
• eu:m-l-c-209-23
• eu:c-394-23-62023cj0394
• eu:c-17-22
• eu:c-621-22-62022cj0621
• eu:c-180-21-62021cj0180
• eu:c-184-20
• eu:c-474-24
• eu:c-200-23-62023cj0200
• eu:c-312-24
• eu:c-26-22

Source: NovaCopilot

Recitals that carry the interpretation

The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.

• Skäl 47 · Article 6

  Legitimate interest can carry direct marketing and security processing, but always requires balancing.

Guidance and secondary law

Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.

• Opinion · EDPB2024-12-18
  Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

  When AI models process personal data: anonymity, legitimate interest and the consequences of unlawfully trained models.

  Article 4, 5, 6

• Guideline · EDPB2024-10-08
  Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR

  The balancing test in Article 6(1)(f): when legitimate interest carries the processing.

  Article 6

• Guideline · EDPB2020-05-04
  Guidelines 05/2020 on consent under Regulation 2016/679

  When consent is valid: freedom, information duties and withdrawal under Articles 4(11) and 7.

  Article 4, 6, 7, 8