CISSP Security and Risk Management Practice Question
Under GDPR, which TWO of the following are valid lawful bases for processing personal data?
⚠ Common exam trap
The trap is selecting plausible-sounding but non-existent bases like 'employment' or 'profit' — candidates must recall the exact six Article 6 bases rather than reasoning from business context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Consent
Under GDPR Article 6(1), the six lawful bases for processing personal data include consent (option C), where the data subject has given clear, specific, informed, and unambiguous agreement, and legitimate interest (option D), where processing is necessary for the legitimate interests pursued by the controller or a third party unless overridden by the data subject's rights and interests. These are both explicitly enumerated lawful bases, making C and D correct. Option A (data subject's employment) is not a lawful basis under Article 6; employment status is not one of the six grounds, though employment context may affect consent validity or other bases. Option B (data processor's request) is invalid because a processor acts only on the controller's documented instructions and cannot itself create a lawful basis for processing. Option E (data controller's profit) is not a recognized lawful basis; profit alone does not satisfy any Article 6 condition, though it might be considered under legitimate interest only if the balancing test is met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data subject's employment
Why it's wrong here
The data subject's employment status is not, in itself, a standalone lawful basis for processing personal data under GDPR Article 6. While data processing related to employment is common, it must be justified by one of the six specified lawful bases. Typically, employment-related data processing falls under the 'performance of a contract' (the employment contract), 'legal obligation' (e.g., tax, social security), or sometimes 'legitimate interest' for specific HR functions, rather than employment being a basis itself.
- ✗
Data processor's request
Why it's wrong here
A data processor's request does not constitute a lawful basis for processing personal data under GDPR. The data processor acts strictly on the instructions of the data controller, as defined in Article 28, and is not responsible for determining the purpose or means of processing. It is the data controller's sole responsibility to identify and establish a valid lawful basis for any personal data processing activity before instructing a processor.
- ✓
Consent
Why this is correct
Consent is a valid lawful basis under GDPR Article 6(1)(a) when the data subject has given their explicit agreement to the processing of their personal data for one or more specific purposes. For consent to be valid, it must be freely given, specific, informed, and unambiguous, signified by a clear affirmative action. Furthermore, the data subject must be able to withdraw their consent as easily as they gave it, and the controller must be able to demonstrate that consent was obtained.
- ✓
Legitimate interest
Why this is correct
Legitimate interest serves as a lawful basis under GDPR Article 6(1)(f) when processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. This basis requires a careful three-part test: identifying a legitimate interest, demonstrating the necessity of the processing, and conducting a balancing test to weigh the controller's interests against the data subject's rights.
- ✗
Data controller's profit
Why it's wrong here
A data controller's profit motive alone is not a lawful basis for processing personal data under GDPR. While many commercial activities are undertaken with the aim of generating profit, the processing of personal data to achieve that profit must still be justified by one of the six specific lawful bases outlined in Article 6. Profit is a business objective, not a legal ground; therefore, controllers must ensure their profit-driven processing aligns with bases like 'contract,' 'legitimate interest' (following a strict balancing test), or 'consent'.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Data processor
A data processor is a person or organization that processes personal data on behalf of a data controller, following the controller's instructions and under their authority.
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.