When can you switch lawful bases?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
The short answer: you generally can't. GDPR requires you to identify your lawful basis before you start processing, and switching after the fact is treated with serious skepticism by regulators.
The thinking behind this: if you could freely switch lawful bases whenever the original one became inconvenient, the requirement to choose one would be meaningless. Regulators have explicitly stated that switching from consent to legitimate interest after people have withdrawn consent is not acceptable.
There are narrow situations where a basis genuinely changes. If your relationship with a subscriber changes (they become a customer, creating a contractual basis where only a consent basis existed before), you might have grounds to update your basis. But this needs to be a real change in circumstances, not a reinterpretation of the same situation.
If you're considering switching, the steps are: document the new basis, document why the switch is legitimate, update your privacy notice to reflect the change, and in some cases notify the individuals affected.
In practice, most questions about switching arise when consent rates drop or when people are withdrawing consent faster than expected. The answer there isn't to switch to legitimate interest. It's to examine why people are withdrawing and whether your original consent capture was genuinely compliant.
See how the two main email bases compare and how lawful basis affects suppression handling when someone withdraws.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
