A lawful basis is the legal ground that permits an organization to process personal data or contact a person. In privacy and security programs, it is the justification behind collection, storage, sharing, and outreach. Common bases include consent, contractual necessity, legal obligation, and legitimate interests, and the chosen basis should match the purpose and be documented.
It matters in cyber security because data handling must be defensible, not just technically possible. If a company cannot show a valid lawful basis, it may be forced to stop processing, delete records, or face regulatory action. In real defenses, teams map each data flow to a lawful basis, log when consent was obtained or withdrawn, and review whether a new use still fits the original purpose. In attacks, weak or unclear lawful-basis records can help an intruder abuse contact lists, harvested profiles, or reused permissions for spam, phishing, or unauthorized outreach.