GDPR.ME.UK · WORKING DOCUMENT 71

Lawful basis, LIA and privacy notice review

Complete the basis decision for each purpose before drafting notices. Use the LIA section for ordinary legitimate interests; recognised legitimate interest is a separate, restricted statutory basis.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Use alongside the lawful bases and privacy notices guide and evidence-to-action method.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Map each purpose to a lawful basis

Identify the purpose, affected people, information and processing operation. Explain necessity and the factual basis for the choice.
Consider the current Article 6 bases: consent, contract, legal obligation, vital interests, public task, ordinary legitimate interests and recognised legitimate interest.
For recognised legitimate interest, identify the exact statutory purpose and conditions. Do not use the label as a general marketing basis.

Activity / purpose / owner

Data subjects and data categories

Chosen Article 6 basis

Necessity and supporting facts

Specific law or recognised-interest provision if applicable

Reviewer / date / supporting evidence

2. Check sensitive-data conditions

Identify an additional Article 9 condition for special-category information or Article 10 authorisation for criminal-offence information, where relevant.
Check any applicable DPA Schedule 1 condition and its safeguards, including whether an Appropriate Policy Document is required.
Record the actual condition and evidence; do not assume ordinary legitimate interests alone authorise sensitive processing.

Special-category or criminal-offence information

Article 9 condition / Article 10 authorisation

DPA condition and specific safeguards

APD required? Reason / document reference

Retention and access protections

Condition review date

3. Complete the ordinary legitimate interests assessment

Purpose test: identify whose interest is pursued, the benefit, whether it is lawful and its importance.
Necessity test: explain why the processing is needed and why a less intrusive reasonable alternative does not achieve the aim.
Balancing test: consider reasonable expectations, the relationship, sensitive information, vulnerability, impact, safeguards and the ability to object. Record the conclusion and reassessment triggers.

Interest pursued and beneficiary

Purpose-test evidence

Necessity and alternatives

Expectations / vulnerability / potential impact

Safeguards / objections handling

Balance conclusion / approver / review triggers

4. Test consent where used

Check that the request is clear, specific, informed, freely given and separate from unrelated terms. Use an affirmative choice and keep evidence of what was agreed.
Test withdrawal in practice and explain the consequences accurately. Consider whether an imbalance of power makes consent unsuitable.
Distinguish GDPR consent from the PECR channel or device-storage consent that may also be required.

Consent wording and version

Purpose / channel / affirmative action

Information shown at collection

Date / source / evidence record

Withdrawal route and test result

Power imbalance or conditionality assessment

5. Review the privacy notice and delivery journey

Check identity and contacts, DPO/representative details where relevant, purposes, lawful bases, interests, recipients, transfers, retention, applicable rights, complaints and relevant automated decision information.
For indirect collection, review source and categories plus Article 14 timing and any properly supported exception. For direct collection, provide required information at collection.
Check whether provision of information is a statutory or contractual requirement and explain relevant consequences. Publish a clear route for complaints to the controller and the regulator.
Use accessible layers for website, worker, patient/client and CCTV contexts; check that published statements match operational practice.

Notice audience and version

Article 13 / Article 14 checklist findings

Collection source and delivery time

Controller complaint route and ICO route

Automated decisions / transfer / retention wording

Accessibility and operational accuracy test

6. Approve and maintain

Resolve contradictory bases, missing conditions and misleading statements before relying on the record.
Record publication, staff communication and related ROPA or contract updates.
Set review triggers for changed purposes, technology, legal requirements or supplier practices.

Required changes and owner

Approval decision / evidence / date

Publication and communication record

Linked ROPA / DPIA / APD / contract

Next review and triggers

Outstanding issues

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.