(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

(d) Vital interests: the processing is necessary to protect someone’s life.

(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

⁠

A guide to lawful basis | ICO

⁠

There are no rows in this table

⁠

Each lawful basis needs to be considered individually, taking into account the ICO Guidance. It is likely that, for a SAVVI Purpose, as a public body …

where you have a statutory-obligation/duty to provide a service, select (c)

otherwise, where you have established a remit/power to provide a service, select (e)

otherwise, where the purpose is essential to saving lives, select (d)

otherwise, in limited circumstances there may be a case for a Public Body to select (f)

A SAVVI vulnerability initiative would be unlikely to use (a), or (b)