Use this page to document the Article 6 basis for each processing purpose, decide when consent is valid, and keep evidence that survives withdrawal, purpose changes, and record-of-processing review.
Covers consent, contract, legal obligation, vital interests, public task, legitimate interests, Article 7 consent conditions, Article 9 special-category distinction, and RoPA evidence.
Structured answer sets in this page tree.
Cited legal and guidance references.
GDPR lawful-basis work starts before processing begins. For each purpose, record one Article 6 basis, explain why that basis fits the facts, separate consent from other grounds, and add Article 9 analysis when the data is special category data.
Article 6 says processing is lawful only if at least one listed basis applies. The six bases are consent, contract, legal obligation, vital interests, public task or official authority, and legitimate interests.
Do not treat consent as the default. The selected basis should match the purpose and facts at collection time, because EDPB consent guidance warns against presenting consent while relying on another basis or retrospectively moving from consent to legitimate interests after consent problems appear.
Consent is valid only when the request and the user's action meet GDPR conditions. The controller must be able to demonstrate consent, keep consent requests distinguishable from other matters, use clear and plain language, inform the person about withdrawal before consent is given, and make withdrawal as easy as giving consent.
Consent requests should be granular by purpose. EDPB guidance treats separate opt-ins, clear purpose descriptions, controller identity, data types, withdrawal information, and a clear affirmative action as central to valid consent.
Article 6(1)(f) has its own test: identify the controller's or third party's interest, show that the processing is necessary for that interest, and check whether the data subject's interests or fundamental rights and freedoms override it. The GDPR text calls out children as requiring particular protection in this balancing.
Legitimate interests should be recorded separately from consent. A product cannot ask for consent and then silently continue the same purpose under legitimate interests when consent is withdrawn.
Article 9 is separate from Article 6. If the data reveals or concerns racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health, sex life, or sexual orientation, the Article 9 prohibition must also be addressed.
Explicit consent under Article 9(2)(a) is only one possible exception. Do not turn every special-category use into a consent workflow when another Article 9 condition is the actual ground or where Union or Member State law affects whether consent can lift the prohibition.
The evidence record should be purpose-level, not page-level. A single product feature may need different bases for account creation, billing, support, security logging, analytics, marketing, and research.
For consent, evidence must show more than a current configuration setting. EDPB guidance says the controller should be able to show how consent was obtained, when it was obtained, what information was provided at the time, and that the workflow met the criteria for valid consent.
No. EDPB consent guidance says the controller must decide the lawful basis in advance and cannot retrospectively rely on legitimate interests when consent is invalid or withdrawn.
No. Special category processing needs an Article 9 condition, and explicit consent is only one Article 9(2) condition. The record should still identify the Article 6 basis for the processing purpose.
It should prove who consented, when and how consent was given, the purpose and information shown at the time, the affirmative action used, the consent workflow version, and the withdrawal method.
Sorena can help map each processing purpose to an Article 6 basis, identify consent and Article 9 issues, and keep the evidence needed for notices, withdrawal handling, and RoPA review.
Ask source-linked questions about Article 6 lawful bases, Article 7 consent, Article 9 special-category data, and evidence records using the cited sources on this page.
Review your consent flows, legitimate-interest records, special-category analysis, and RoPA fields with Sorena.
"What is my reason or justification"
"granular and meaningful information"
"how consent was obtained"
"Records of processing activities"