This page helps document the Article 6 basis for each processing purpose, decide when consent is valid, and keep evidence that survives withdrawal, purpose changes, and record-of-processing review.
Covers consent, contract, legal obligation, vital interests, public task, legitimate interests, Article 7 consent conditions, Article 9 special-category distinction, and RoPA evidence.
Structured answer sets in this page tree.
Cited legal and guidance references.
Choose the GDPR before processing starts and apply it to a specific purpose. Record why the Article 6 condition fits the facts, do not keep an alternative basis in reserve for the same purpose, and run a separate Article 9 check when the processing involves .
Article 6 says processing is lawful only if at least one listed basis applies. The six bases are , contractual necessity, legal obligation, vital interests, a public task or official authority, and . The controller must still comply with the GDPR principles, including purpose limitation, data minimisation, fairness, and transparency.
Do not treat as the default. Select the basis from the actual purpose, relationship, and necessity before collection. EDPB consent guidance warns against presenting consent while relying on another basis or retrospectively moving the same processing from consent to when consent is invalid or withdrawn.
is valid only when the request and the person's action meet GDPR conditions. The controller must be able to demonstrate consent, keep the request distinguishable from other matters, use clear and plain language, inform the person about withdrawal before consent is given, and make withdrawal as easy as giving consent.
requests should be granular by purpose. EDPB guidance treats separate opt-ins, clear purpose descriptions, controller identity, data types, withdrawal information, and a clear affirmative action as central to valid consent.
Article 6(1)(f) has its own test: identify the controller's or third party's interest, show that the processing is necessary for that interest, and check whether the person's interests or fundamental rights and freedoms override it. The GDPR gives particular weight to a child's interests in this balancing.
should be recorded separately from . A product cannot ask for consent and then silently continue the same purpose under legitimate interests when consent is withdrawn.
Article 9 is separate from Article 6. If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or genetic data, biometric data used for unique identification, health data, or data about sex life or sexual orientation, the Article 9 prohibition must also be addressed.
Explicit under Article 9(2)(a) is only one possible exception. Do not turn every special-category use into a consent workflow when another Article 9 condition is the actual ground or where Union or Member State law affects whether consent can lift the prohibition.
Keep the evidence at purpose level, not page level. A single product feature may need different bases for account creation, billing, support, security logging, analytics, marketing, and research. Connect that analysis to the .
For , evidence must show more than a current configuration setting. EDPB guidance says the controller should be able to show how consent was obtained, when it was obtained, what information was provided at the time, and that the workflow met the criteria for valid consent.
No, not for the same processing purpose. EDPB guidance says the controller must decide the in advance and cannot retrospectively rely on when consent is invalid or withdrawn. A separate purpose may have its own lawful basis, but it must be assessed and disclosed on its own facts.
No. Special category processing needs an Article 9 condition, and explicit is only one Article 9(2) condition. The record should still identify the Article 6 basis for the processing purpose.
It should show who consented, when and how was given, each purpose and the information shown at the time, the affirmative action used, the consent workflow version, and the withdrawal method. Keep only the evidence needed to demonstrate consent.
The controller must stop the processing that depended on . Withdrawal does not affect the lawfulness of processing before withdrawal. Data may be retained only where a separate purpose and support that retention, such as compliance with a legal obligation or the establishment, exercise, or defence of legal claims. The withdrawn purpose cannot continue.
Sorena can help map each processing purpose to an Article 6 basis, identify consent and Article 9 issues, and keep the evidence needed for notices, withdrawal handling, and RoPA review.
Ask questions tied to cited sources about Article 6 lawful bases, Article 7 consent, Article 9 special-category data, and evidence records using the cited sources on this page.
Review your consent flows, legitimate-interest records, special-category analysis, and RoPA fields with Sorena.
"What is my reason or justification"
"granular and meaningful information"
"how consent was obtained"
"Records of processing activities"