# Lawful basis, LIA and privacy notice review

Complete the basis decision for each purpose before drafting notices. Use the LIA section for ordinary legitimate interests; recognised legitimate interest is a separate, restricted statutory basis.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Map each purpose to a lawful basis

- Identify the purpose, affected people, information and processing operation. Explain necessity and the factual basis for the choice.
- Consider the current Article 6 bases: consent, contract, legal obligation, vital interests, public task, ordinary legitimate interests and recognised legitimate interest.
- For recognised legitimate interest, identify the exact statutory purpose and conditions. Do not use the label as a general marketing basis.

Activity / purpose / owner: 
Data subjects and data categories: 
Chosen Article 6 basis: 
Necessity and supporting facts: 
Specific law or recognised-interest provision if applicable: 
Reviewer / date / supporting evidence: 

## 2. Check sensitive-data conditions

- Identify an additional Article 9 condition for special-category information or Article 10 authorisation for criminal-offence information, where relevant.
- Check any applicable DPA Schedule 1 condition and its safeguards, including whether an Appropriate Policy Document is required.
- Record the actual condition and evidence; do not assume ordinary legitimate interests alone authorise sensitive processing.

Special-category or criminal-offence information: 
Article 9 condition / Article 10 authorisation: 
DPA condition and specific safeguards: 
APD required? Reason / document reference: 
Retention and access protections: 
Condition review date: 

## 3. Complete the ordinary legitimate interests assessment

- Purpose test: identify whose interest is pursued, the benefit, whether it is lawful and its importance.
- Necessity test: explain why the processing is needed and why a less intrusive reasonable alternative does not achieve the aim.
- Balancing test: consider reasonable expectations, the relationship, sensitive information, vulnerability, impact, safeguards and the ability to object. Record the conclusion and reassessment triggers.

Interest pursued and beneficiary: 
Purpose-test evidence: 
Necessity and alternatives: 
Expectations / vulnerability / potential impact: 
Safeguards / objections handling: 
Balance conclusion / approver / review triggers: 

## 4. Test consent where used

- Check that the request is clear, specific, informed, freely given and separate from unrelated terms. Use an affirmative choice and keep evidence of what was agreed.
- Test withdrawal in practice and explain the consequences accurately. Consider whether an imbalance of power makes consent unsuitable.
- Distinguish GDPR consent from the PECR channel or device-storage consent that may also be required.

Consent wording and version: 
Purpose / channel / affirmative action: 
Information shown at collection: 
Date / source / evidence record: 
Withdrawal route and test result: 
Power imbalance or conditionality assessment: 

## 5. Review the privacy notice and delivery journey

- Check identity and contacts, DPO/representative details where relevant, purposes, lawful bases, interests, recipients, transfers, retention, applicable rights, complaints and relevant automated decision information.
- For indirect collection, review source and categories plus Article 14 timing and any properly supported exception. For direct collection, provide required information at collection.
- Check whether provision of information is a statutory or contractual requirement and explain relevant consequences. Publish a clear route for complaints to the controller and the regulator.
- Use accessible layers for website, worker, patient/client and CCTV contexts; check that published statements match operational practice.

Notice audience and version: 
Article 13 / Article 14 checklist findings: 
Collection source and delivery time: 
Controller complaint route and ICO route: 
Automated decisions / transfer / retention wording: 
Accessibility and operational accuracy test: 

## 6. Approve and maintain

- Resolve contradictory bases, missing conditions and misleading statements before relying on the record.
- Record publication, staff communication and related ROPA or contract updates.
- Set review triggers for changed purposes, technology, legal requirements or supplier practices.

Required changes and owner: 
Approval decision / evidence / date: 
Publication and communication record: 
Linked ROPA / DPIA / APD / contract: 
Next review and triggers: 
Outstanding issues: 

## Sources

- ICO: Guide to lawful basis: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/
- ICO: Special-category conditions: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-rules-on-special-category-data/
- ICO: Privacy information checklist: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/checklists/
- ICO: Controller complaints handling: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/