Legal basis guidance
Help with filling in the legal basis section of the DARS online form, including how to identify your legal basis under GDPR.
Select the legal basis under UK GDPR
Most applications will require a legal basis from Article 6 and Article 9 under GDPR.
This is because health data is considered to be both personal data and special category data.
You are responsible for making sure the legal basis is the most appropriate for your use case. You will need to provide a justification for the legal basis you select in the purpose section of your application.
Help with legal basis
Some typical legal bases for common use cases are:
- Article 6(1)(e) public task - often used by universities for research
- Article 6(1)(f) legitimate interest - often used by commercial organisations
You can use the following resources to help you determine the most appropriate legal basis.
Read ICO guidance on:
- Article 6 and the lawful basis for processing personal data
- Article 9 and the lawful basis for processing special category data
You can also use the ICO's lawful basis interactive guidance tool.
For research applications, read the Medical Research Council guidance.
Your information governance team and data protection officer can help you if you are unsure.
Last edited: 12 May 2026 12:17 pm