Checks / Obligations / Use personal data lawfully and openly
Obligation · 22 controls · 6 laws
Use personal data lawfully and openly
Personal data needs a lawful basis, a clear privacy notice, consent where required and use only for the stated purpose.
What to put in place
Record the lawful basis for each use of personal data, show a clear notice and keep to the stated purpose.
Policy wording you can use
[your organisation] uses personal data only on a recorded lawful basis, tells people clearly how their data is used at the point of collection, collects no more than it needs and uses it only for the stated purpose.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 21 controls here that take a yes or a document (the rest need their own number or date and are listed after).
Every control that asks for this
GDPR (UK and EU)
- GDPR Art.5 - processing purpose stated
- GDPR Art.5 - data minimisation applied
- GDPR Art.6 - lawful basis recorded
- GDPR Art.7 - consent is recorded
- GDPR Art.9 - special-category safeguard
- GDPR Art.13 - privacy notice shown
- GDPR Art.37 - DPO appointed where required
- GDPR Art.44 - international transfer mechanism
- GDPR Art.46 - appropriate safeguards (SCCs)
- GDPR Art.26 - joint-controller arrangement
- GDPR Art.40 - code of conduct adhered
Agent output: compliance gates
- GDPR Art.5 - processing purpose stated
- GDPR Art.6 - lawful basis recorded
- GDPR Art.9 - special-category safeguard flag
- GDPR Art.13 - privacy notice shown
- GDPR Art.44 - international transfer mechanism