Art.6 Lawfulness of processing
Process personal data only where at least one lawful basis applies: the data subject's consent, necessity for a contract with the data subject or pre-contractual steps at their request, compliance with a legal obligation
5
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Legitimate interests assessments showing the interest pursued, the necessity test and the balancing against the data subject's rights · Data governance / DLP tooling
- Compatibility assessments for each secondary use, covering the five factors Article 6(4) names · Document repository
- Evidence that the basis stated to the data subject in the privacy information matches the one recorded internally · Data governance / DLP tooling
governing documentDocuments that govern the control
- A lawful basis recorded per processing activity, not per system or per department · Document repository
- The Union or Member State provision cited where the basis is legal obligation or public task · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Consent recorded as the basis where the processing would happen regardless of the answer, which makes it neither free nor the real basis
- Legitimate interests asserted with no balancing test on file, or a balancing test that never reaches an adverse conclusion for any activity
- One lawful basis applied to a whole system that covers several distinct processing purposes
- The basis switched after the fact when the first one fails, rather than settled before processing began
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.5 Principles relating to processing of personal data · Art.7 Conditions for consent