What evidence do auditors commonly ask for on Art.6 Lawfulness of processing?

A lawful basis recorded per processing activity, not per system or per department; Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights; The Union or Member State provision cited where the basis is legal obligation or public task; Compatibility assessments for each secondary use, covering the five factors Article 6(4) names; Evidence that the basis stated to the data subject in the privacy information matches the one recorded internally.

What is the most common gap auditors find on Art.6?

Consent recorded as the basis where the processing would happen regardless of the answer, which makes it neither free nor the real basis

GDPR · Chapter II - Principles

`Art.6` Lawfulness of processing

Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation, protection of vital interests, performance of a public interest task or exercise of official authority, or legitimate interests that are not overridden by the data subject's interests, rights and freedoms. Public authorities cannot rely on legitimate interests for processing carried out in performance of their tasks. Where the basis is legal obligation or public task, that basis must be laid down in Union or Member State law and the purpose must be determined in it. Before processing for a purpose other than the one collected for, without consent or a legal mandate, assess compatibility against the link between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.

Source: GDPR, Art.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights · Data governance / DLP tooling
Compatibility assessments for each secondary use, covering the five factors Article 6(4) names · Document repository
Evidence that the basis stated to the data subject in the privacy information matches the one recorded internally · Data governance / DLP tooling

governing documentDocuments that govern the control

A lawful basis recorded per processing activity, not per system or per department · Document repository
The Union or Member State provision cited where the basis is legal obligation or public task · Document repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Consent recorded as the basis where the processing would happen regardless of the answer, which makes it neither free nor the real basis
Legitimate interests asserted with no balancing test on file, or a balancing test that never reaches an adverse conclusion for any activity
One lawful basis applied to a whole system that covers several distinct processing purposes
The basis switched after the fact when the first one fails, rather than settled before processing began

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.5 Principles relating to processing of personal data · Art.7 Conditions for consent