AI Governance Engineer
GitHub

GDPR Art. 6: lawful basis per processing moment

A lawful basis for each processing operation, assessed separately for training, fine-tuning, retrieval and inference

By Reviewed

From clause to evidenceThe chain from GDPR Art. 6 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 6ClauseGDPRArt. 6Duty holder: ControllerDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25In forceArtefact: Basis registry per dataset and stage; versioned legitimate-interest assessmentArtefactBasis registryper dataset…Layer: Layer 02 Inventory & TransparencyLayerLayer 02Inventory &TransparencyEvidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic in 14 frameworks (21 clauses): GDPR, NIST AI RMF, CSA AICM, OWASP LLM, CoE Convention, China GenAI Measures,GAO AI Accountability and 7 moreAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 6 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 6ClauseGDPR · Art. 6Duty holder: ControllerDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25 · In forceArtefact: Basis registry per dataset and stage; versioned legitimate-interest assessmentArtefactBasis registry per dataset…Layer: Layer 02 Inventory & TransparencyLayerLayer 02Inventory & TransparencyEvidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic in 14 frameworks (21 clauses):GDPR, NIST AI RMF, CSA AICM, OWASP LLM, CoEConvention and 9 moreAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART6. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 6.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: Basis registry per dataset….
  • Layer: Layer 02 Inventory & Transparency.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • The same topic in 14 other frameworks; the crosswalk section below links each clause.
When this obligation appliesThe date of AIGE-OBL-GDPR-ART6 on a time axis, against its review date 2026-09-24.Earlier2024202620282030As of 2026-09-242018-05-25 · In force2018-05-25 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-GDPR-ART6 on a time axis, against its review date 2026-09-24.2018-05-25 · In force2024202620282030EarlierAs of 2026-09-242018-05-25 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-GDPR-ART6
DateStepDetail
2018-05-25In force
Id
AIGE-OBL-GDPR-ART6
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 6
In scope
Controller
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

Basis registry per dataset and stage; versioned legitimate-interest assessment.

What this obligation connects toGDPR Art. 6 and its 15 relations: 1 open controls, 14 same crosswalk topic.DirectColour: stack layer of the pattern or control02 InventoryGDPR Art. 6Open controls (1)AIGE-CTL-DATA-004 Lawful Basis and Assessment per Processing Stage · DirectLawful Basis and Assessment…Same crosswalk topic (14)AI Verify 8.3.1, 8.3.2, 1.4.1 · Core clauseAI VerifyCSA AICM DSP-08, DSP-22 · Core clauseCSA AICMChina GenAI Measures GenAI Art. 7(3), GenAI Art. 11 · Core clauseChina GenAI MeasuresCoE Convention CoE Art. 11 · Core clauseCoE ConventionGAO AI Accountability 2.8 · Core clauseGAO AI AccountabilityGDPR Art. 5, Art. 25, Art. 35 · Core clauseGDPR+8 more+8 more: NIST AI RMF MEASURE 2.10, OWASP LLM LLM02:2026, EU AI Act Art. 59, Art. 4a, G7 Code G7 Action 11, ISO 42001 A.7, OECD AI Principles OECD 1.2, Singapore GenAI GenAI 2, UK DUAA UK GDPR Art. 22B
What this obligation connects toGDPR Art. 6 and its 15 relations: 1 open controls, 14 same crosswalk topic.DirectColour: stack layer of the pattern or control02 InventoryOpen controls (1)AIGE-CTL-DATA-004 Lawful Basis and Assessment per Processing Stage · DirectLawful Basis and Assessment…Same crosswalk topic (14)AI Verify 8.3.1, 8.3.2, 1.4.1 · Core clauseAI VerifyCSA AICM DSP-08, DSP-22 · Core clauseCSA AICMChina GenAI Measures GenAI Art. 7(3), GenAI Art. 11 · Core clauseChina GenAI MeasuresCoE Convention CoE Art. 11 · Core clauseCoE ConventionGAO AI Accountability 2.8 · Core clauseGAO AI AccountabilityGDPR Art. 5, Art. 25, Art. 35 · Core clauseGDPR+8 more+8 more: NIST AI RMF MEASURE 2.10, OWASP LLM LLM02:2026, EU AI Act Art. 59, Art. 4a, G7 Code G7 Action 11, ISO 42001 A.7, OECD AI Principles OECD 1.2, Singapore GenAI GenAI 2, UK DUAA UK GDPR Art. 22BGDPR Art. 6
What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.
Data table: every relation
Relations of AIGE-OBL-GDPR-ART6
FamilyItemRelation
Open controlsAIGE-CTL-DATA-004 Lawful Basis and Assessment per Processing StageDirect
Same crosswalk topicAI Verify 8.3.1, 8.3.2, 1.4.1Core clause
Same crosswalk topicCSA AICM DSP-08, DSP-22Core clause
Same crosswalk topicChina GenAI Measures GenAI Art. 7(3), GenAI Art. 11Core clause
Same crosswalk topicCoE Convention CoE Art. 11Core clause
Same crosswalk topicGAO AI Accountability 2.8Core clause
Same crosswalk topicGDPR Art. 5, Art. 25, Art. 35Core clause
Same crosswalk topicNIST AI RMF MEASURE 2.10Core clause
Same crosswalk topicOWASP LLM LLM02:2026Core clause
Same crosswalk topicEU AI Act Art. 59, Art. 4aRelated clause
Same crosswalk topicG7 Code G7 Action 11Related clause
Same crosswalk topicISO 42001 A.7Related clause
Same crosswalk topicOECD AI Principles OECD 1.2Related clause
Same crosswalk topicSingapore GenAI GenAI 2Related clause
Same crosswalk topicUK DUAA UK GDPR Art. 22BRelated clause

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Privacy and data protection

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 6: lawful basis per processing moment (AIGE-OBL-GDPR-ART6). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art6. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 6: lawful basis per processing moment (AIGE-OBL-GDPR-ART6)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art6},
  note         = {Version 0.5.0}
}