Consent is not the default
Choose the lawful basis that matches the real purpose and relationship before collection. Consent is invalid when it is bundled, coerced, vague, or impossible to withdraw without detriment.
Article 5 operating principles
Processing must be lawful, fair, and transparent; purpose-limited; minimized; accurate; retained no longer than necessary; and protected with appropriate integrity and confidentiality. Accountability means the controller must be able to demonstrate those properties.
Article 6 lawful bases
| Basis | Appropriate decision test | Frequent failure |
|---|---|---|
| Consent | The person has a genuine, informed, specific, withdrawable choice | Pre-ticked boxes, bundled purposes, or no consent record |
| Contract | Processing is objectively necessary to perform or enter the requested contract | Calling convenient profiling or marketing contractually necessary |
| Legal obligation | A specific EU or Member State legal duty requires processing | Citing “compliance” without identifying the duty |
| Vital interests | Processing is necessary to protect life or another vital interest | Using it for ordinary operational convenience |
| Public task | Applicable law gives the controller a public-interest task or authority | Used by a private organization without a legal foundation |
| Legitimate interests | A real interest is necessary and not overridden by the person’s rights | No necessity test, balancing assessment, or right to object |
Special-category data under Article 9 and criminal-offence data under Article 10 require additional conditions and safeguards; an Article 6 basis alone is not enough.
Engineering control pattern
For each purpose, keep a machine-readable or auditable record of:
- purpose and data fields;
- Article 6 basis and any Article 9 condition;
- source and collection interface;
- notice version shown at collection;
- recipients and transfers;
- retention trigger and deletion behavior;
- consent event and withdrawal event where applicable;
- legitimate-interest assessment where applicable; and
- owner and review date.
Purpose changes must trigger review before reuse. A new model, feature, integration, audience, or data enrichment is not automatically compatible with the original purpose.
Primary references
- Gdpr
- Lawful basis
- Consent
- Data minimization
- Retention
Note Metadata
Aliases: GDPR Article 5, GDPR Article 6, Lawful Processing
Source: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng