What is Lawful Basis for Processing?
A lawful basis for processing is the legal reason you rely on to collect, store or use someone’s personal data (for example under GDPR). For surveys and forms you must pick and document an appropriate basis — common ones are consent, legitimate interests, public task and legal obligation.
‘Lawful basis for processing’ is a data-protection concept that explains why an organisation is allowed to handle a person’s personal information. Different laws use different words, but the practical idea is the same: you must have a valid, recorded reason before you collect or use personal data. Typical lawful bases relevant to surveys and forms include:
- Consent: the person agrees to their data being used for a specific purpose.
- Legitimate interests: you have a legitimate business or organisational reason and it doesn’t override the person’s rights.
- Public task: a public authority processes data to perform an official duty.
- Legal obligation: you must process data to comply with a law (e.g., statutory reporting).
Choosing the right basis affects what you must tell participants, which rights they can exercise (for example withdrawing consent), and how long you can keep the data. Special category (sensitive) data usually needs stronger justification — often explicit consent or a specific legal condition.
Usage example
A council running a neighbourhood consultation decides the lawful basis is ‘public task’ because the feedback informs statutory planning decisions; the council publishes a privacy notice in each supported language explaining this. A charity collecting health-related outcomes asks for explicit consent before asking sensitive questions and keeps a record of the consent for audit.
Practical application
Why this matters: picking and documenting a lawful basis is a legal and practical requirement that shapes how you design your survey. It determines what you must tell respondents (privacy notice text and translated consent prompts), how you allow people to exercise rights (withdraw consent, access data), and what safeguards you must apply to sensitive responses. For Hearo users this affects features you should enable: clear, translated consent prompts; language-specific privacy notices; minimal data collection; audit logs showing who changed the survey; and a review workflow for translated consent wording. Before launching a multilingual survey, identify the personal data you’ll collect, choose the most appropriate lawful basis, record the justification, and present the required information in every language participants can use.
FAQ
How do I choose between consent and legitimate interests for a survey?
Use consent when people should have a real choice and you need clear agreement (especially for sensitive topics). Use legitimate interests when you have a reasonable organisational need (e.g., service improvement) and you can demonstrate it doesn’t override participants’ rights — document a balancing test and offer an opt-out. If in doubt, consult your data protection officer or legal adviser.
Do I need separate consent for each language version of the survey?
You need to present the same information and capture agreement in whatever language the participant uses. That means translated privacy notices and consent prompts so participants understand what they’re agreeing to; Hearo’s translation workflow helps ensure those texts are accurate and reviewable.
What if my survey asks for sensitive (special category) data?
Sensitive data (health, religion, ethnicity, etc.) generally requires stronger justification than ordinary personal data. Often you’ll need explicit consent or a specific legal condition. Reduce collection to what you truly need, explain why you’re asking, and store those responses with extra safeguards. Get legal advice if you expect to collect special category information.
Can participants withdraw their consent, and what happens then?
Yes — if your lawful basis is consent, participants must be able to withdraw it easily. Withdrawal doesn’t necessarily erase data used while consent was valid, but you should stop future processing based on consent and explain the consequences. If your lawful basis is something else (e.g., legal obligation), withdrawal may not apply; your privacy notice should explain participants’ rights clearly in every language offered.