--- title: "EU GDPR Lawful Basis and Consent Guide" canonical_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent" source_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent" author: "Sorena AI" description: "Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records." published_at: "2026-05-09" updated_at: "2026-07-16" keywords: - "EU GDPR" - "Article 6" - "lawful basis" - "consent" - "Article 7" - "legitimate interests" - "Article 9" - "special category data" - "RoPA" - "GDPR" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU GDPR Lawful Basis and Consent Guide Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records. *Artifact Guide* *EU GDPR* ## GDPR lawful basis and consent This page helps document the Article 6 basis for each processing purpose, decide when consent is valid, and keep evidence that survives withdrawal, purpose changes, and record-of-processing review. Covers consent, contract, legal obligation, vital interests, public task, legitimate interests, Article 7 consent conditions, Article 9 special-category distinction, and RoPA evidence. GDPR lawful-basis work starts before processing begins. For each purpose, record one Article 6 basis, explain why that basis fits the facts, separate consent from other grounds, and add Article 9 analysis when the data is special category data. ## Article 6 bases to choose from before processing Article 6 says processing is lawful only if at least one listed basis applies. The six bases are consent, contract, legal obligation, vital interests, public task or official authority, and legitimate interests. Do not treat consent as the default. The selected basis should match the purpose and facts at collection time, because EDPB consent guidance warns against presenting consent while relying on another basis or retrospectively moving from consent to legitimate interests after consent problems appear. - Consent: use only where the person can make a free, specific, informed, and unambiguous choice for one or more specific purposes. - Contract: use where processing is necessary for a contract with the data subject or pre-contract steps requested by the data subject. - Legal obligation: use where processing is necessary for a controller's legal obligation under applicable Union or Member State law. - Vital interests: use where processing is necessary to protect vital interests of the data subject or another natural person. - Public task or official authority: use where processing is necessary for a task in the public interest or official authority vested in the controller. - Legitimate interests: use where the controller or a third party has a legitimate interest, the processing is necessary for that interest, and the data subject's interests, rights, and freedoms do not override it. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 6 lists the lawful bases and requires at least one to apply before processing is lawful. - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en?ref=sorena.io) - Explains that controllers must decide the applicable lawful basis before collection and cannot swap from consent to another basis after consent is withdrawn or invalid. - [Data Protection Commission - Guidance on Legal Bases for Processing Personal Data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Summarizes the Article 6 bases and frames lawful-basis selection as a controller question: why is this personal data being processed? ## Consent conditions under Article 7 Consent is valid only when the request and the user's action meet GDPR conditions. The controller must be able to demonstrate consent, keep consent requests distinguishable from other matters, use clear and plain language, inform the person about withdrawal before consent is given, and make withdrawal as easy as giving consent. Consent requests should be granular by purpose. EDPB guidance treats separate opt-ins, clear purpose descriptions, controller identity, data types, withdrawal information, and a clear affirmative action as central to valid consent. - Do not use pre-ticked boxes, silence, inactivity, blanket terms acceptance, or merely continuing to use a service as consent. - Do not bundle unnecessary processing into contract acceptance or make a service conditional on consent for data that is not necessary for that service. - Keep consent information clear enough for the audience, including the controller identity, each purpose, the data types used, and how withdrawal works. - When consent is collected in a product interface, preserve the version of the request, screen or flow, information shown, timestamp or session evidence, and the action that signaled agreement. - Refresh or re-collect consent when the processing operation changes or evolves so much that the original consent no longer covers it. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 7 sets the controller's burden to demonstrate consent and the rules for distinguishable requests, withdrawal, and conditionality. - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en?ref=sorena.io) - Details the elements of free, specific, informed, and unambiguous consent, including granularity, clear affirmative action, and proof records. ## Legitimate interests are not consent with an opt-out label Article 6(1)(f) has its own test: identify the controller's or third party's interest, show that the processing is necessary for that interest, and check whether the data subject's interests or fundamental rights and freedoms override it. The GDPR text calls out children as requiring particular protection in this balancing. Legitimate interests should be recorded separately from consent. A product cannot ask for consent and then silently continue the same purpose under legitimate interests when consent is withdrawn. - State the specific interest rather than a broad label such as analytics, fraud, or business improvement. - Explain why the personal data and processing operation are necessary for that interest. - Record the balancing outcome, including foreseeable effects on the data subject and any safeguards that reduce impact. - Escalate where the data subject is a child, the processing is unexpected, the relationship has a power imbalance, or the processing would continue after a user objects or withdraws consent. - Keep the legitimate-interest record linked to the same processing purpose in the RoPA so notices, controls, and evidence do not conflict. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 6(1)(f) defines legitimate interests and the override by the data subject's interests, rights, and freedoms. - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en?ref=sorena.io) - Explains that controllers cannot retrospectively use legitimate interests to justify processing after consent validity problems. ## Special category data needs a separate Article 9 check Article 9 is separate from Article 6. If the data reveals or concerns racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health, sex life, or sexual orientation, the Article 9 prohibition must also be addressed. Explicit consent under Article 9(2)(a) is only one possible exception. Do not turn every special-category use into a consent workflow when another Article 9 condition is the actual ground or where Union or Member State law affects whether consent can lift the prohibition. - First record the Article 6 basis for the processing purpose. - Then record whether Article 9 applies and, if it does, which Article 9(2) condition is relied on. - Separate ordinary consent under Article 6(1)(a) from explicit consent under Article 9(2)(a). - Do not infer national derogations, healthcare rules, employment rules, or public-interest grounds unless the supporting law is identified in the evidence record. - Flag Article 10 separately when criminal convictions or offences data is involved. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 9 defines special categories of personal data and lists conditions that can lift the Article 9(1) prohibition. - [Data Protection Commission - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Recommends adding the Article 6 legal basis and Article 9 basis for special-category data as useful RoPA information. ## Evidence records for lawful basis, consent, and withdrawal The evidence record should be purpose-level, not page-level. A single product feature may need different bases for account creation, billing, support, security logging, analytics, marketing, and research. For consent, evidence must show more than a current configuration setting. EDPB guidance says the controller should be able to show how consent was obtained, when it was obtained, what information was provided at the time, and that the workflow met the criteria for valid consent. - RoPA row: processing activity, purpose, categories of data subjects, personal data categories, recipients, retention, safeguards where applicable, Article 6 basis, and Article 9 basis where special-category data is involved. - Lawful-basis memo: factual purpose, chosen Article 6 basis, rejected alternatives when relevant, transparency notice location, owner, approver, and reassessment trigger. - Consent proof: request wording, interface or form version, purpose granularity, controller identity shown, data types described, affirmative action captured, timestamp or session link, and withdrawal route shown before consent. - Withdrawal record: date of withdrawal, purpose stopped, downstream suppression or deletion action, any separate lawful basis for continued retention, and user notice if the basis changes. - Legitimate-interest record: interest, necessity analysis, balancing outcome, child or vulnerable-person considerations, safeguards, objection handling, and notice language. **Can a GDPR team choose consent first and switch to legitimate interests later?** No. EDPB consent guidance says the controller must decide the lawful basis in advance and cannot retrospectively rely on legitimate interests when consent is invalid or withdrawn. **Does special category data only need explicit consent?** No. Special category processing needs an Article 9 condition, and explicit consent is only one Article 9(2) condition. The record should still identify the Article 6 basis for the processing purpose. **What should a GDPR consent record prove?** It should prove who consented, when and how consent was given, the purpose and information shown at the time, the affirmative action used, the consent workflow version, and the withdrawal method. Sources for this answer: - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en?ref=sorena.io) - Describes consent proof records, including how consent was obtained, when it was obtained, and the information provided to the data subject at the time. - [Data Protection Commission - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Explains that RoPAs should contain granular and meaningful information and can include Article 6 and Article 9 basis fields. - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 30 sets records-of-processing requirements and Article 7 requires controllers to demonstrate consent. *Recommended next step* *Placement: before sources* ## Build consent, legitimate-interest, and RoPA evidence from the same cited record Sorena can help map each processing purpose to an Article 6 basis, identify consent and Article 9 issues, and keep the evidence needed for notices, withdrawal handling, and RoPA review. - [Open Research Copilot for EU GDPR](/solutions/research-copilot.md): Ask questions tied to cited sources about Article 6 lawful bases, Article 7 consent, Article 9 special-category data, and evidence records using the cited sources on this page. - [Talk through GDPR lawful-basis records](/contact.md): Review your consent flows, legitimate-interest records, special-category analysis, and RoPA fields with Sorena. ## Primary sources - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Primary GDPR text for Article 6 lawful bases, Article 7 consent conditions, Article 9 special-category conditions, Article 10 criminal-offence data, and Article 30 records. - Quote: "Processing shall be lawful only if" - [EDPB Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en?ref=sorena.io) - Guidance used for consent validity, granularity, affirmative action, proof records, withdrawal, and the rule against switching lawful bases after consent problems. - Quote: "clear affirmative action" - [Data Protection Commission - Guidance on Legal Bases for Processing Personal Data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Controller-facing guidance used for Article 6 lawful-basis selection and the six legal bases. - Quote: "legal basis" - [Data Protection Commission - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Records guidance used for granular RoPA evidence and optional Article 6 and Article 9 basis fields. - Quote: "Article 6 legal basis" ## Related Topic Guides - [Does the EU GDPR apply outside the EU under Article 3?](/artifacts/eu/general-data-protection-regulation/faq/territorial-scope.md): An official source GDPR Article 3 territorial-scope FAQ covering EU establishment, offering goods or services, monitoring behavior in the EU, and Article 27 representatives. - [EU GDPR Applicability Test for Products, Vendors, and Data Flows](/artifacts/eu/general-data-protection-regulation/applicability-test.md): A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence. - [EU GDPR Article 30 RoPA Intake Workflow](/artifacts/eu/general-data-protection-regulation/ropa-intake-workflow.md): This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live. - [EU GDPR Article 6 Legal Bases FAQ](/artifacts/eu/general-data-protection-regulation/faq/legal-bases.md): FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data. - [EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence](/artifacts/eu/general-data-protection-regulation/automated-decision-making-and-profiling.md): GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence. - [EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow](/artifacts/eu/general-data-protection-regulation/breach-notification-72-hours.md): Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs. - [EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records](/artifacts/eu/general-data-protection-regulation/breach-notification-workflow.md): A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records. - [EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/checklist.md): This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence. - [EU GDPR Children and Special-Category Data Guide](/artifacts/eu/general-data-protection-regulation/children-and-special-categories.md): GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence. - [EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/compliance.md): Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties. - [EU GDPR Controller, Processor, and Joint Controller Roles](/artifacts/eu/general-data-protection-regulation/controller-processor-and-joint-controller-roles.md): Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence. - [EU GDPR Data Subject Rights and DSAR Workflow](/artifacts/eu/general-data-protection-regulation/data-subject-rights-and-dsar-workflow.md): GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence. - [EU GDPR deadlines and compliance calendar](/artifacts/eu/general-data-protection-regulation/deadlines-and-compliance-calendar.md): GDPR operating calendar for rights-request timing, breach notification, DPIA and prior-consultation gates, transfer reviews, retention checks, and evidence. - [EU GDPR DPIA and Prior Consultation Workflow](/artifacts/eu/general-data-protection-regulation/dpia-and-prior-consultation-workflow.md): Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required. - [EU GDPR DPIA and risk management under Articles 35 and 36](/artifacts/eu/general-data-protection-regulation/dpia-and-risk-management.md): EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits. - [EU GDPR DSAR Exceptions: refusal, extensions, identity checks](/artifacts/eu/general-data-protection-regulation/faq/dsar-exceptions.md): FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15. - [EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence](/artifacts/eu/general-data-protection-regulation/dsar-workflow.md): Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records. - [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers](/artifacts/eu/general-data-protection-regulation/faq.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers. - [EU GDPR International Transfers and SCCs: Chapter V evidence guide](/artifacts/eu/general-data-protection-regulation/international-transfers-and-sccs.md): GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks. - [EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lawful-basis-and-lia-workflow.md): Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f). - [EU GDPR Lead Supervisory Authority and One-Stop-Shop](/artifacts/eu/general-data-protection-regulation/lead-authority-and-one-stop-shop.md): How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together. - [EU GDPR LIA Template for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lia-template.md): This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence. - [EU GDPR penalties and fines: Article 83 tiers and evidence](/artifacts/eu/general-data-protection-regulation/penalties-and-fines.md): EU GDPR penalties and fines guide covering Article 83 fine tiers, assessment factors, Article 58 powers, and evidence records for controllers and processors. - [EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide](/artifacts/eu/general-data-protection-regulation/processor-contracts-and-vendor-management.md): EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable. - [EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields](/artifacts/eu/general-data-protection-regulation/record-of-processing-activities-template.md): Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures. - [EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers](/artifacts/eu/general-data-protection-regulation/requirements.md): Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers. - [EU GDPR Retention and Erasure Schedule](/artifacts/eu/general-data-protection-regulation/retention-and-erasure-schedule.md): Build an EU GDPR retention and erasure schedule around storage limitation, Article 17 erasure grounds, Article 12 rights handling, Article 19 recipient notices, and Article 30 RoPA fields. - [EU GDPR SCC Transfer Impact Assessment FAQ](/artifacts/eu/general-data-protection-regulation/faq/scc-transfer-impact-assessment.md): cited FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required. - [EU GDPR Transfer TIA and SCC Workflow](/artifacts/eu/general-data-protection-regulation/transfer-tia-and-scc-workflow.md): A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers. - [EU GDPR Transparency Notices: Articles 12, 13 and 14](/artifacts/eu/general-data-protection-regulation/transparency-notices.md): GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing. - [EU GDPR vs Brazil LGPD: GDPR-led comparison and source gaps](/artifacts/eu/general-data-protection-regulation/gdpr-vs-lgpd.md): Compare EU GDPR duties with Brazil LGPD only where the available sources support the comparator, with GDPR rows for lawful basis, rights, breach, transfers, roles, and evidence. - [EU GDPR vs California CCPA: Evidence Reuse Boundaries](/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa.md): Identify which GDPR privacy records may help a California workstream and which CCPA/CPRA scope, rights, contract, timing, and enforcement questions need California-specific support. - [EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications](/artifacts/eu/general-data-protection-regulation/gdpr-vs-eprivacy.md): Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance. - [EU GDPR vs UK GDPR: Evidence and Transfer Boundaries](/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr.md): Compare EU GDPR obligations with UK GDPR transfer notes based on EU GDPR sources, covering scope, lawful basis, rights, accountability, records, DPIAs, security, and transfers. - [GDPR processor vs controller: role boundaries and evidence](/artifacts/eu/general-data-protection-regulation/faq/processor-vs-controller.md): Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records. - [GDPR vs EU AI Act: privacy controls for AI systems](/artifacts/eu/general-data-protection-regulation/gdpr-vs-ai-act.md): Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers. - [GDPR vs EU Data Act: personal data safeguards and source limits](/artifacts/eu/general-data-protection-regulation/gdpr-vs-data-act.md): Compare GDPR obligations with the EU Data Act only where the sources cited on this page support the fact pattern, with clear safeguards for personal data, rights, transfers, and accountability. - [When does the EU GDPR require a DPIA?](/artifacts/eu/general-data-protection-regulation/faq/dpia-threshold.md): Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements. - [When does the GDPR 72-hour breach notification clock start?](/artifacts/eu/general-data-protection-regulation/faq/breach-awareness-clock.md): GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent.md