Lawful bases explained for business owners
Agentric Team ·
Every bit of personal data processing needs a lawful basis under UK GDPR. The term sounds lawyerly; the reality for a business answering its phone is simple. Here's the map.
The six lawful bases (and the three that matter to you)
UK GDPR lists six: consent, contract, legal obligation, vital interests, public task, legitimate interests. For a business running an AI receptionist, three do the work:
Legitimate interests — the flexible one. Processing data for a genuine business interest that doesn't override the person's rights. Answering someone who called you is the textbook case: a caller expects to be answered, expects their details captured, expects a booking. Documenting the reasoning (a simple "legitimate interests assessment" — we provide the template) is the formal step.
Contract — when processing is necessary to deliver what someone asked for. Once a caller becomes a customer — booked a service, engaged your firm — their records live under contract.
Consent — the one with strict rules (freely given, specific, informed, withdrawable). Needed for things like marketing communications to non-customers — not needed for answering their enquiry. Where you want marketing consent, the widget/chat asks for it explicitly.
How it maps to Agentric's features
| Processing | Basis |
|---|---|
| Answering the call/chat | Legitimate interests |
| Transcript + recording | Legitimate interests (with disclosure) |
| Booking their appointment | Contract (forming) |
| Contact record + memory | Legitimate interests |
| Marketing emails to prospects | Consent |
| Transactional emails (confirmations) | Contract/legitimate interests |
What "documented" means
The ICO expects you to write down your basis reasoning — a short assessment for legitimate interests (purpose, necessity, balancing test). Our DPA pack includes a worked template; a couple of paragraphs honestly reasoned is genuinely sufficient for a small business.
What it means in practice
Get the bases right in the documentation, disclose what's happening (the AI + recording notices), keep data only as long as your retention policy says, honour access/deletion requests — and you're doing UK GDPR properly. It's less exotic than the vocabulary suggests.