01 · The two lawful grounds, and only two
Section 4 is the gate: personal data may only be processed for a lawful purpose, on one of exactly two grounds — consent under Section 6, or a "certain legitimate use" under Section 7. There's no third, catch-all basis sitting underneath those two. If your processing isn't covered by a person's consent, it has to be covered by something Section 7 itself names — not by an internal memo concluding the business interest outweighs the privacy interest.
02 · Why that's a meaningfully narrower idea
GDPR's "legitimate interest" is a balancing test an organisation can run for itself, case by case, against almost any processing activity. Section 7's "legitimate uses" is a short, specific, enumerated list the Act writes out directly — things like personal data a person voluntarily provides for a specified purpose and hasn't indicated they don't consent to, processing required to comply with a law or a court order or judgment, and a handful of other named situations. It's closed. You can't argue your way into a new one.
03 · Consent itself has its own bar
Even where consent is the ground you're relying on, Section 6 is specific about what counts: free, specific, informed, unconditional, and unambiguous, given through clear affirmative action. A pre-ticked box, a buried "by continuing you agree," or consent bundled with something unrelated doesn't clear that bar just because a person technically clicked something.
04 · What this means for how a notice gets written
The practical consequence is that every purpose on a consent notice needs an honest, specific answer to "what's the legal basis for this one" — consent, or the exact legitimate use it falls under, never a vague "business operations." An answer that can't point at Section 6 or a specific Section 7 ground is an answer that isn't actually settled yet. That's the question we make every purpose answer before it ever reaches a notice in Consent Tree — and where a purpose doesn't have a stated basis yet, the system says so plainly rather than guessing one in.
What the Act actually says — S.4 allows exactly two lawful grounds: consent (S.6) or a named "legitimate use" (S.7) — a closed list, not a general-purpose balancing test.