# Lawful Basis Assessment Workflow Reference

## Assessment Initiation Workflow

1. **Trigger identification**: A lawful basis assessment is required when:
   - A new processing activity is being designed (privacy by design, Art. 25).
   - An existing processing activity is being materially changed (new purpose, new data category, new recipient).
   - A periodic review cycle triggers reassessment (annual minimum).
   - A complaint or data subject request raises questions about the lawful basis.
   - A DPIA identifies lawful basis as a risk factor.

2. **Assign assessment owner**: The processing owner (business unit lead) completes the assessment with support from the DPO.

3. **Gather processing details**: Before the assessment can proceed, document:
   - Specific purpose(s) of the processing
   - Categories of personal data involved
   - Categories of data subjects
   - Whether special category data (Art. 9) or criminal offence data (Art. 10) is involved
   - Data flows (collection, storage, sharing, transfer)
   - Whether the controller is a public authority

## Lawful Basis Evaluation Workflow

### Evaluation of Art. 6(1)(c) — Legal Obligation

1. Identify the specific EU or Member State law that imposes the obligation.
2. Verify the law specifically requires the processing of personal data (not merely permits it).
3. Confirm the processing is limited to what the law mandates (no scope expansion).
4. Document the legal provision with section/article reference.
5. If confirmed, record Art. 6(1)(c) as the lawful basis and proceed to documentation.

### Evaluation of Art. 6(1)(b) — Contract Performance

1. Identify the specific contract with the data subject.
2. For each data element, apply the necessity test: "Would the contract be impossible to perform without processing this specific data for this specific purpose?"
3. Distinguish between core contractual obligations and optional enhancements.
4. If the processing relates to pre-contractual steps, verify these were requested by the data subject (not initiated by the controller).
5. Reject overly broad interpretations (personalisation, cross-selling, analytics are typically not necessary for contract performance per EDPB Guidelines 2/2019).
6. If confirmed, record Art. 6(1)(b) and proceed to documentation.

### Evaluation of Art. 6(1)(f) — Legitimate Interests

1. **Purpose test**: Articulate the specific legitimate interest pursued by the controller or a third party:
   - Is the interest lawful (not prohibited by law)?
   - Is the interest clearly articulated (not vague)?
   - Is the interest real and present (not hypothetical)?

2. **Necessity test**: Determine whether the processing is necessary for the stated interest:
   - Could the interest be achieved without processing personal data?
   - Could a less intrusive method achieve the same result?
   - Is the processing proportionate to the interest?

3. **Balancing test**: Weigh the controller's interest against the data subject's rights:
   - Nature of the data (sensitive data weighs against the controller)
   - Reasonable expectations of the data subject
   - Likely impact on the data subject (trivial vs significant)
   - Status of the data subject (children, vulnerable persons)
   - Relationship between controller and data subject
   - Safeguards in place (pseudonymisation, data minimisation, opt-out)

4. If the balance favours the controller, record Art. 6(1)(f) and document the full LIA.
5. If the balance favours the data subject, consider consent or do not process.

### Evaluation of Art. 6(1)(a) — Consent

1. Verify that consent can be freely given:
   - No power imbalance (employer-employee, authority-citizen)
   - No conditionality (access to service not dependent on unnecessary consent)
   - No detriment for refusing or withdrawing

2. Design the consent mechanism:
   - Clear, plain language request
   - Granular options for distinct purposes
   - Affirmative opt-in action required
   - Withdrawal mechanism at least as easy as giving consent

3. Implement record-keeping:
   - Who consented
   - When consent was given
   - What they were told
   - How they consented
   - Whether consent has been withdrawn

4. If valid consent can be obtained and maintained, record Art. 6(1)(a).

## Special Category Data Additional Workflow

When special category data (Art. 9(1)) is involved:

1. First establish the Art. 6(1) lawful basis using the standard workflow above.
2. Then identify the applicable Art. 9(2) condition:
   - (a) Explicit consent — higher standard than standard consent
   - (b) Employment, social security, social protection law
   - (g) Substantial public interest — requires Member State law basis
   - (h) Healthcare purposes — by or under responsibility of health professional
3. Document both the Art. 6 basis and the Art. 9(2) condition in the assessment record.

## Documentation and Approval Workflow

1. Complete the Lawful Basis Assessment form with:
   - Processing activity name and RoPA reference
   - Assessment date and assessor
   - Selected lawful basis with article reference
   - Rationale for selection
   - Rationale for rejecting alternative bases
   - Necessity analysis
   - Supporting evidence (law reference, contract reference, LIA, consent mechanism design)
   - Special category data condition if applicable
   - Next review date

2. Submit to DPO for review and sign-off.
3. Update the RoPA with the confirmed lawful basis.
4. Update the privacy notice to reflect the stated lawful basis for the processing activity.
5. If consent is the basis, implement the consent mechanism before processing begins.
6. File the assessment in the accountability evidence register.

## Periodic Review Workflow

1. Annual review: Reassess all lawful basis selections against any changes in:
   - Processing purposes or scope
   - Applicable legislation
   - Regulatory guidance or case law
   - Data subject expectations
   - Organisational circumstances

2. Event-triggered review: Reassess immediately when:
   - A data subject complaint challenges the lawful basis
   - A supervisory authority issues new guidance relevant to the processing
   - The processing activity is materially modified
   - A DPIA or audit identifies a lawful basis concern

3. Document the review outcome (confirmed/changed) and update all dependent records.