Explicit GDPR Lawful Basis Statements: What Articles 13 and 14 Require in Your Privacy Notice

In January 2023, Ireland’s Data Protection Commission fined Meta a combined 390 million euros over how Facebook and Instagram handled personal data for advertising. Part of the decision was not about what Meta did with data at all. It was about what Meta told people. Regulators found that users were not given clear information about which legal basis applied to which processing purpose. The lesson for every organization with a website and a privacy notice is blunt: under the GDPR, saying what you collect is not enough. You have to say, purpose by purpose, why the law lets you do it.

Does Your Privacy Notice State a Lawful Basis for Every Purpose?

This guide explains what an explicit lawful-basis statement is, what GDPR Articles 6, 13 and 14 require, the mistakes that most often get privacy notices criticized, and a six-step framework for writing a statement that holds up with regulators, plaintiffs and your own customers.

What an Explicit Lawful-Basis Statement Is

An explicit lawful-basis statement is the part of your privacy notice that ties each processing purpose to the specific Article 6(1) legal basis you rely on. Article 13(1)(c) requires controllers who collect data directly from individuals to provide the purposes of the processing as well as the legal basis for it, at the time the data is obtained. Article 14(1)(c) imposes the same duty when data comes from another source, with notice generally due within a reasonable period and no later than one month. The six lawful bases under Article 6(1) are:

• Consent of the individual for one or more specific purposes.
• Necessity for the performance of a contract with the individual, or steps taken at their request before entering a contract.
• Necessity for compliance with a legal obligation.
• Necessity to protect vital interests.
• Necessity for a task carried out in the public interest or in the exercise of official authority.
• Necessity for the legitimate interests of the controller or a third party, unless overridden by the individual’s rights and freedoms.

The word “explicit” here describes the quality of the disclosure. It is not the same thing as “explicit consent,” which is a separate and higher consent standard for special category data under Article 9. Many privacy notices blur these two ideas, so keep them apart in your drafting.

Why the Statement Matters More Than It Looks

There are four reasons this single paragraph of your notice carries outsized weight.

1. Enforcement exposure. Transparency duties in Articles 12 to 14 fall under the data subject rights provisions that Article 83(5)(b) places in the higher fine tier, up to 20 million euros or 4 percent of total worldwide annual turnover, whichever is higher. Violations of the Article 5 principles and Article 6 basics sit in the same tier.
2. Rights depend on the basis. The basis you choose determines which rights apply. The right to withdraw consent applies when you rely on consent, and Article 13(2)(c) requires you to say so. The right to data portability under Article 20 applies to processing based on consent or contract. The right to object under Article 21 applies to processing based on public interest or legitimate interests. If your statement is wrong or vague, your rights handling will be wrong too.
3. You generally cannot switch bases after the fact. Regulators have taken the position that a controller cannot quietly swap from one lawful basis to another when the first one is challenged. Choosing wrongly at the start can leave you without a defensible position later.
4. It is the document everyone reads. Regulators, plaintiffs’ counsel, procurement teams and journalists all start with your notice. A statement that contradicts what your website actually does becomes evidence.

Common Mistakes That Draw Criticism

Regulators and advocacy groups keep flagging the same patterns:

• The blanket list. A sentence such as “we rely on consent, contract, legal obligation and legitimate interests” with no mapping to purposes tells the reader nothing. The statement must connect each purpose to its basis.
• Legitimate interests as a catch-all. Using it for everything, without naming the interest or performing and documenting the balancing test, fails Article 13(1)(d), which requires you to state the legitimate interests pursued when you rely on Article 6(1)(f).
• Stretching contract necessity. Necessity means the processing is objectively required to deliver the service the individual asked for. Behavioral advertising is rarely necessary to deliver a service, which is the point at the center of the Meta decisions.
• Consent plus a fallback. Telling people you rely on consent while privately planning to fall back on legitimate interests if they say no undermines the idea that consent was a real choice.
• Bundled purposes. Combining analytics, personalization, advertising and product research in one consent or one line obscures what each basis actually covers.
• Drift. The notice was accurate when written, then marketing added a new pixel, an AI feature or a data broker integration, and nobody updated it.
• Banner and notice disagreement. The cookie banner asks for consent while the notice says the same processing is based on legitimate interests.

What Good Looks Like: A Purpose-by-Purpose Table

The cleanest format is a table that a layperson can scan. Each row states the purpose in plain language, the data involved, the basis, and the practical consequence for the individual’s rights. An illustrative example:

Purpose	Data used	Lawful basis	What it means for you
Creating and managing your account and fulfilling your order	Name, email, delivery address, payment confirmation	Contract, Article 6(1)(b)	Needed to provide what you requested; you may be unable to use the service without it
Tax and accounting records	Transaction records	Legal obligation, Article 6(1)(c)	We must keep these for the legally required period
Securing our website and preventing fraud	IP address, device data, login events	Legitimate interests, Article 6(1)(f): protecting our systems and customers	You may object; we weigh your interests against ours
Advertising and cross-site measurement using cookies and pixels	Browsing activity, identifiers	Consent, Article 6(1)(a)	Optional; you can withdraw at any time as easily as you gave it
Marketing emails to existing customers	Email address, purchase history	Legitimate interests or consent, depending on national ePrivacy rules and your facts	You can unsubscribe at any time

Note that the final row is deliberately conditional. Direct marketing is where the GDPR and national ePrivacy rules interact, and the right basis depends on the channel, the relationship and the country. Do not copy a table like this into your own notice without checking it against your actual processing.

A Six-Step Framework for Writing Your Statement

Step 1: Map every processing purpose

Start from what the business actually does, not from last year’s notice. Pull from your records of processing, your vendor list, your tag inventory and product roadmap. Include marketing technology and AI features, which are the usual blind spots.

Step 2: Assign one primary basis per purpose

Decide the basis for each purpose and write down why. If a purpose legitimately has two bases, such as a legal obligation for retention and a contract for delivery, split it into two purposes or explain each clearly. Avoid assigning a basis because it is administratively convenient.

Step 3: Document the test behind each basis

For legitimate interests, complete and keep a legitimate interests assessment covering the purpose, necessity and balancing. For contract, document why the processing is objectively necessary. For consent, confirm it meets the standards for being freely given, specific, informed and unambiguous, and that you can prove it was given.

Step 4: Write the statement in plain language

Name the purpose, the basis and the consequence. State the legitimate interest where you rely on one. Say whether providing the data is a statutory or contractual requirement and what happens if the person declines, as Article 13(2)(e) requires. Use a layered format with a short summary table up top and detail underneath.

Step 5: Make the website behave the way the notice says

If the notice says advertising tags rely on consent, those tags must not fire until the visitor opts in. If it says an individual can withdraw consent, withdrawal must work and be as easy as giving consent. Align your cookie banner, preference center, rights request workflow and vendor disclosures so they tell one consistent story. Remember that cookies and similar technologies also face separate consent rules under the ePrivacy Directive as implemented nationally, and the two regimes need to be handled together.

Step 6: Monitor, version and re-approve

Treat the statement as a controlled document. Assign an owner, review it on a schedule and trigger a review whenever a new tool, vendor, data source or purpose goes live. Keep dated versions so you can show what your notice said on any given day.

Do Not Forget the UK and Other Regimes

The UK GDPR mirrors these transparency requirements, and the ICO expects the same purpose-level clarity. If you are outside the EU but offer goods or services to people in it, or monitor their behavior, you may also need an Article 27 representative, so check that your notice and your representative arrangements line up. Several non-European laws now ask for similar disclosures about purposes, categories and recipients, which makes a well-built purpose map reusable across regimes. Note: this article is general information and not legal advice. Lawful basis analysis depends on your facts, your country and current regulator guidance, so have qualified counsel review your specific processing.

How Captain Compliance Helps

Captain Compliance helps teams keep their lawful-basis statements and their live websites in agreement. Our consent management platform holds advertising and analytics tags until a visitor consents and records each choice, our dynamic privacy policies and vendor disclosures keep your notice current as your technology changes, our DSAR workflows route rights requests according to the right basis, and our Patrol monitoring flags new trackers that your notice does not yet describe. Through our partnership with EU Presence, we also support Article 27 representation for organizations that need it.

The Meta Lesson: Why Vague Lawful-Basis Statements Are a GDPR Enforcement Risk

Frequently Asked Questions

Does the GDPR require me to state my lawful basis in my privacy notice?

Yes. Article 13(1)(c) requires controllers collecting data directly from individuals to state the purposes and the legal basis for each processing activity, and Article 14(1)(c) requires the same when data is obtained from other sources.

Can I list several lawful bases for the same purpose?

Listing a vague set of bases without tying them to purposes is a common criticism. Choose the basis that genuinely applies to each purpose, document why, and avoid presenting a fallback basis in case consent is refused.

Is explicit consent the same as an explicit lawful-basis statement?

No. An explicit lawful-basis statement is a transparency requirement about telling people which basis you rely on. Explicit consent is a higher standard of consent that Article 9 generally requires for processing special category data when consent is the exception relied upon.

What must I say if I rely on legitimate interests?

Article 13(1)(d) requires you to state the legitimate interests pursued by you or a third party. You should also complete and retain a legitimate interests assessment, and tell people they can object under Article 21.

Can I change my lawful basis later?

Changing bases after processing has begun is generally treated with suspicion by regulators, and you cannot simply swap one basis for another when the first one fails. The safer approach is to choose carefully at the outset and update your notice and records whenever a purpose genuinely changes.