Lawful basis should be mapped per purpose, system behaviour, and notice, not chosen once and forgotten.
Consent is only one Article 6 route, and where it is used the proof and withdrawal model must be as strong as the collection flow.
Structured answer sets in this page tree.
Cited legal and guidance references.
The most common lawful-basis failure is not choosing the wrong label once. It is letting the purpose, the actual system behaviour, the notice, and the evidence drift apart over time. A workable GDPR model starts with a purpose register, assigns the lawful basis for each purpose, records why that basis is appropriate, and forces changes through the same review path that governs product and marketing changes. Where consent is used, you also need a proof, withdrawal, and downstream-enforcement model.
Do not assign lawful basis by product or by team. Assign it by concrete processing purpose.
That is the only way to keep the register aligned with notices, retention, and rights handling.
Legitimate interests is often operationally useful, but it needs a real balancing assessment and a clear objection path.
Without that record, the basis tends to collapse under scrutiny.
Research Copilot can take EU GDPR Lawful Basis and Consent from clarifying scope and applicability with cited answers to a reusable workflow inside Sorena. Teams working on EU GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from EU GDPR Lawful Basis and Consent and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for EU GDPR Lawful Basis and Consent.