Implementing Lawful Basis Assessment

Overview

Every processing activity under GDPR must have a valid lawful basis established before processing begins. Article 6(1) provides six mutually non-exclusive bases. Selecting the wrong basis creates compliance risk, may invalidate the processing entirely, and can result in enforcement action. This skill provides a systematic methodology for evaluating and documenting the appropriate lawful basis.

The Six Lawful Bases — Art. 6(1)

(a) Consent

The data subject has given consent to the processing of their personal data for one or more specific purposes.

Requirements per Art. 7 and Recital 32:

• Freely given: genuine choice, no imbalance of power, no conditionality (Art. 7(4))
• Specific: granular consent for distinct processing purposes
• Informed: clear plain language about identity, purpose, data types, rights
• Unambiguous: clear affirmative action (no pre-ticked boxes, no silence)
• Withdrawable: as easy to withdraw as to give (Art. 7(3))

Best suited for: Marketing communications, cookies/tracking, research participation, sharing data with third parties for their own purposes.