Choosing a Lawful Basis for Processing Customer Data

UK e-commerce businesses must select an appropriate lawful basis under GDPR before collecting or using customer personal data for sales or marketing. The three most relevant bases are consent, contract, and legitimate interests.

Each basis has different requirements and works better for specific activities. Choosing the wrong one can lead to compliance problems, so it is important to match the basis to the purpose and document your decision clearly.

Understanding the Three Main Lawful Bases

GDPR requires a lawful basis for every instance of processing personal data. For most UK e-commerce operations the practical choices are consent, contract, and legitimate interests. The chosen basis must fit the specific purpose and you must be able to demonstrate why it applies.

Consent means the individual has given clear, informed, and freely given agreement. Contract covers processing that is necessary to fulfil a contract or to take steps before entering one. Legitimate interests allows processing where the business has a genuine business need that is not outweighed by the individual’s rights and freedoms.

You may rely on different bases for different activities. For example, you might use contract to process an order and legitimate interests to send service updates, while needing consent for promotional emails.

Consent in E-commerce Marketing and Sales

Consent is required for many marketing communications, especially where you want to send electronic direct marketing such as email newsletters or SMS promotions. The individual must take a positive action, such as ticking an unticked box, and you must tell them exactly what they are agreeing to.

Keep records of when and how consent was obtained, what the person was told, and the version of your privacy notice at the time.
Make withdrawal of consent as easy as giving it, usually via a clear unsubscribe link in every marketing email.
Avoid making consent a condition of sale unless the marketing is strictly necessary for the service.

In practice many e-commerce stores add a separate optional tick box at checkout for marketing consent. This keeps the purchase separate from the marketing choice and helps demonstrate that consent is freely given.

Using Contract as Your Lawful Basis

Contract is the most straightforward basis for processing data needed to complete a sale. This includes name, delivery address, email for order confirmation, and payment details required to fulfil the order.

Examples of processing covered by contract include:

Sending order confirmation and dispatch emails.
Passing delivery details to a courier to complete shipment.
Updating the customer on changes to their order that are necessary to perform the contract.

You do not need separate consent for these essential communications. However, contract does not cover later marketing messages or using the data for unrelated purposes. If you want to use the email address for promotional campaigns later, you will usually need consent or another basis.

Legitimate Interests for Marketing and Service Messages

Legitimate interests can support some marketing and most service or operational messages, provided you carry out a legitimate interests assessment (LIA) and the individual’s rights do not override your interest.

A typical LIA has three parts: identify the legitimate interest, show that the processing is necessary to achieve it, and balance this against the individual’s interests, rights and freedoms. For example, sending an email to confirm account creation or to ask for product feedback after delivery is often acceptable under legitimate interests.

For marketing, legitimate interests is sometimes used for limited “soft opt-in” scenarios where the person bought from you recently, you are offering similar products, and you gave a clear chance to opt out at the point of sale and in every message. Always document your LIA and keep it under review.

Practical Steps to Choose and Document the Right Basis

Follow these steps when deciding on a lawful basis for a new activity:

Clearly define the purpose of the processing and list exactly what data you will use.
Check whether the activity is necessary to perform a contract with the customer.
If not, consider whether consent is realistic and meaningful for that purpose.
If consent is not suitable, carry out a legitimate interests assessment and decide whether your business need outweighs the customer’s privacy rights.
Document the basis, the reasoning, and any safeguards in your internal records.
Update your privacy notice to explain the basis and your customers’ rights.

Review your choices regularly, especially when you introduce new marketing channels or change how you use data. Train anyone who handles customer data so they understand which basis applies to each activity.

Common Pitfalls and How to Avoid Them

Many early-stage e-commerce businesses assume one basis covers everything or rely on pre-ticked boxes for consent. Both approaches create compliance risk. Pre-ticked boxes do not constitute valid consent under UK rules.

Another frequent mistake is using legitimate interests for all marketing without completing an LIA or offering a genuine right to object. Customers must be told about their right to object to processing based on legitimate interests, and you must stop if they object unless you can show compelling reasons.

Keep marketing lists separate from transactional lists. Use clear labelling in your customer relationship management system so team members know which customers have given marketing consent and which have not.

Putting It Into Practice at Your Startup

Start simple. Use contract for everything directly linked to fulfilling orders. Add a clear, unticked marketing consent box at checkout and record the outcome against each customer record. For service emails that are not strictly required by the contract, complete a short legitimate interests assessment and keep it with your compliance documents.

When you grow and add new tools such as advertising pixels or loyalty programmes, repeat the process for each new purpose. Free resources on GOV.UK and the Information Commissioner’s Office website provide templates for privacy notices, consent records and legitimate interests assessments.

Loomworks in Liversedge offers selected founders free desks, a registered address and operator mentoring with no fees or equity taken. Such support can give early-stage teams more time to focus on getting these foundational legal and operational details right.

Frequently asked questions

Can I use the same lawful basis for all customer data processing?

No. Different activities require different bases. Processing an order usually relies on contract while sending promotional emails normally needs consent. You must identify and document a lawful basis for each separate purpose. Mixing them without clear records creates compliance risk.

Does legitimate interests allow me to send marketing emails without consent?

Only in limited soft opt-in situations where the customer has previously bought from you, you are offering similar products or services, and you gave them an easy chance to refuse at the time of purchase and in every subsequent message. For most cold or broad marketing you will need consent.

What records should I keep to prove my lawful basis?

Keep a record of which basis applies to each processing activity, why you chose it, when you made the decision, and any supporting documents such as legitimate interests assessments or copies of consent wording. These records should be updated if your purposes or methods change.

Do I need fresh consent every time I send a marketing email?

No. Valid consent can last until the customer withdraws it or the purpose becomes outdated. However you must make withdrawal easy, usually with an unsubscribe link, and you should refresh consent periodically if you have not contacted the person for a long time.

How often should I review my lawful basis choices?

Review them whenever you introduce new marketing activities, change data uses, or update your systems. Many businesses carry out an annual check as part of wider compliance housekeeping. Document each review so you can show ongoing attention to the rules.