What this review helps you do
A lawful-basis review starts with a specific purpose, not a preferred tick-box. Record the reason for using the information, the appropriate basis and any additional sensitive-data conditions, then check that the notice and the actual collection process explain the same activity.
AT A GLANCE
Match each purpose to a valid legal basis and explain it clearly to the people affected. Test what happens in practice against what your notices promise.
Who should use this review?
All organisations collecting or using personal information, with enhanced review for health, employment, legal and profiling activities.
What to review
- Map every purpose to its Article 6 basis and documented justification.
- Where relevant, record the Article 9 condition or Article 10 authorisation and applicable DPA 2018 condition; identify whether an Appropriate Policy Document is required.
- Use an LIA for ordinary legitimate interests and test consent collection and withdrawal where consent is relied on.
- Review website, worker, patient/client and CCTV notices for content, accessibility, timing, sources of indirectly obtained information and actual practice.
Working outputs
- Purpose-by-purpose lawful basis register.
- LIAs and any required Appropriate Policy Document.
- Revised layered privacy notices and a publication/update record.
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
Is there a justified lawful basis for each processing purpose?
Evidence to look for: Basis register with an explanation, not just a ticked category.
If it is missing: Document purpose-specific decisions before processing.
Are additional sensitive-data conditions and APD requirements addressed?
Evidence to look for: Article 9/10 condition and required DPA 2018 safeguards.
If it is missing: Identify the extra condition and prepare an APD where that condition requires one.
Are LIAs or consent records available where relied on?
Evidence to look for: Purpose/necessity/balancing assessment or demonstrable consent and withdrawal controls.
If it is missing: Complete the appropriate assessment and test operational controls.
Are privacy notices accurate and actively provided at the right time?
Evidence to look for: Current notices and the collection or communication journey.
If it is missing: Reconcile notices with processing and make them accessible when required.
Apply the limits carefully
Recognised legitimate interest is restricted to specified public-interest purposes. It still requires necessity and does not remove other data-protection duties.
Ordinary direct marketing remains subject to ordinary legitimate-interest analysis where that basis is used and to PECR where applicable.
An Appropriate Policy Document is required by specified DPA 2018 conditions, not by every use of special-category information.
Common misunderstandings
Article 6 now contains seven lawful bases, including recognised legitimate interest. That additional basis is already in force and is restricted to its specified purposes and conditions.
An Appropriate Policy Document is required under particular DPA 2018 conditions. It is not automatically required for every use of special-category information.
UK restricted transfers must be assessed under the UK transfer framework. A notice or checklist that refers only to transfers outside the EU may overlook the relevant UK position.
Worked example: separating a staff survey from absence management
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional employer proposes a wellbeing survey alongside its existing absence-management process. The example shows how to organise a review, without selecting a lawful basis for a real employer.
- Control
Distinct purposes need reasoned decisions and accurate explanations to the people affected.
- Evidence
Review the survey questions, whether responses identify workers, access permissions, intended reports and the current worker privacy notice.
- Finding
The invitation calls the survey anonymous, but the export includes names. The existing absence-management entry does not explain the proposed survey use.
- Owner and action
The HR owner pauses the proposed collection while the reviewer assesses necessity, basis and any sensitive-data conditions. The design and notice are amended to match the documented decision.
- Verification
Test the survey and export with fictional data. Confirm the revised wording, permissions and reporting reflect the approved design before collection begins.
Practical questions
Is choosing a lawful basis the whole assessment?
It is one decision within a wider review. Check purpose, necessity, transparency, security, retention and individuals' rights, together with any additional conditions for special-category or criminal-offence information.
What evidence should sit beside a privacy notice?
Keep the purpose and basis decisions, data-flow record, relevant contracts and the tested collection journey. These help show why the notice says what it says and make contradictions easier to find.
Official sources
- ICO — A guide to lawful basis (seven bases) (opens in a new tab)
- ICO — Recognised legitimate interest (opens in a new tab)
- ICO — Rules on special-category data (opens in a new tab)
- ICO — Substantial public interest and APDs (opens in a new tab)
- ICO — Privacy information checklist (opens in a new tab)
- ICO — When to provide privacy information (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.