Processing is lawful only if and to the extent that at least one of the listed bases applies, and the choice is the controller's to make and to defend.
Why it matters when the plan changes
Assessment data is collected about people who cannot easily say no, used to inform decisions that matter to them, and often kept for years. Each of those facts bears on which basis will hold. Article 6 makes lawfulness a precondition, not a formality: processing without a basis that applies is unlawful regardless of intent. Choosing one casually at the start is how an organisation finds, at the point of a complaint, that its processing had no foundation the regulator will accept.
The tension is that the obvious basis is the weakest one. Consent is easy to collect and hard to rely on in employment, because it may not be freely given and can be withdrawn; Recital 43 treats consent as suspect wherever there is a clear imbalance between the person and the controller, which describes most employment settings. Legitimate interest is more durable and requires a documented balancing test that most organisations have never written. The durable route is the one that takes the work.
In practice
An employer runs a leadership assessment on the basis of consent. Two years later one participant withdraws consent and asks for erasure while a succession decision is in progress. The data was legitimately collected, the decision legitimately depends on it, and the basis chosen at the start gives the employer no ground to keep it. The basis was convenient, not durable.
Evidence
Processing is lawful only if and to the extent that at least one of the listed bases applies.
Article 6, General Data Protection Regulation (2016)Consent is unlikely to be freely given where there is a clear imbalance between the person and the controller.
Recital 43, General Data Protection Regulation (2016)
What it cannot tell you
A lawful basis establishes that processing may begin; it says nothing about whether the assessment itself is fair, accurate or proportionate to the decision it informs. Two organisations can rely on the same basis for the same data and produce very different outcomes for the people assessed.
Questions
Article 6 of the General Data Protection Regulation (2016) lists six: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, and legitimate interests. For assessment data in employment, the realistic candidates are usually legitimate interest and, more rarely, contractual necessity.
Not freely. Switching from consent to legitimate interest after consent is withdrawn is treated as unfair, particularly given Recital 43's concern about the clear imbalance between the person and the controller in situations like employment. The basis has to be right at collection, which is why the decision belongs in the design phase.
The employer, as controller. The supplier processes under the employer's documented instructions and can describe what the processing involves, but it cannot supply the basis, because the purposes and the relationship with the people being assessed belong to the employer and not to the supplier.
A documented three-part test: that the interest is legitimate, that the processing is necessary for it, and that it is not overridden by the interests or rights of the people affected. The balancing has to be written down before processing and be available if a person or a regulator asks for it.
No. It is only the entry condition. Purpose limitation, minimisation, transparency, security, retention limits and the person's rights all apply regardless of which basis is used, and a high-risk use case still needs its own impact assessment before any processing starts.