Lawfulness and transparency

Determine the lawful basis

Select and justify the lawful basis for an activity, and trigger the evidence the selected basis requires.

Every processing activity needs one lawful basis, chosen deliberately rather than defaulted to consent because it feels safest. A subscription business billing its customers relies on contract, not consent, and the record should show that reasoning was applied rather than assumed.

Choosing a basis is not the end of the step. Legitimate interests calls for a balancing test, consent calls for a consent record, and a legal obligation calls for the requirement itself to be cited, and the workspace expects that evidence before it will let the activity move forward.

This proves that a basis on the record of processing is never bare; it always carries the document or the record that supports it.

Regulation

Article 6

Registers

Processing activity · Legal requirement · Consent record · Agreement

The steps

1. 01Open the Details tab of the activity and choose the lawful basis from the field provided.
2. 02Write the justification in the field beneath it, in the organisation's own words.
3. 03Where the basis is a legal obligation, open the Linked records band and use "Link a record" to attach the legal requirement.
4. 04Where the basis is consent, attach the consent record in the same way.
5. 05Where the basis is legitimate interests, open the Assessment tab and complete or link the balancing test.
6. 06Check the Gaps panel for the activity to confirm the evidence requirement has cleared.