Document Lawful-Basis Reasoning Beyond a Checkbox
Build a purpose-specific review with evidence, alternatives, rights considerations and implemented safeguards instead of assigning a default lawful-basis label.
10/23/20263 min read
A CRM contains a required lawful_basis field, and every imported contact receives legitimate interests by default. The column is complete, but no one has documented the actual purpose, why personal information is needed, or how the person's interests were assessed. A database value records a conclusion; it does not supply the analysis behind that conclusion.
Create a review record linked to a defined processing activity. It should explain the decision in terms a future reviewer can question, including evidence against proceeding. Use the appropriate qualified privacy or legal owner to determine the applicable basis and conditions.
Describe the activity before choosing a label
State what the organization proposes to do, which personal information it will use, whose information is involved, where it came from, and who will receive it. Separate account research, profiling, outreach, and sharing if they have materially different purposes or effects.
For UK legitimate-interests analysis, the ICO describes a purpose, necessity, and balancing test. A commercial objective alone does not complete that assessment. Other bases and jurisdictions have their own requirements, and channel-specific marketing rules still need separate review.
Do not start with a preferred label and write backward until every answer supports it. A credible assessment can conclude that the proposed activity should be narrowed, redesigned, or stopped.
Use an evidence-based record
The record should include the purpose in plain language, evidence of the benefit sought, data categories, less intrusive alternatives considered, expected effects on individuals, safeguards, and the reviewer's reasoned decision. Add the relevant notices, rights-handling arrangements, retention, and review triggers.
Distinguish evidence from assumptions. “Recipients would expect this” needs support from the relationship and context, not a salesperson's confidence. “Necessary for sales” is too broad to explain why a specific personal detail or intrusive channel is required.
Record unanswered questions explicitly. A blank answer should keep the activity pending, not inherit the basis selected for an unrelated campaign last year.
A fictional review that changes the design
Fictional Cedar Planning wants to identify a business function responsible for warehouse scheduling. Its initial proposal includes named employees, personal mobile numbers, inferred seniority, and a broad promotional sequence. The reviewer asks whether the purpose can be served with less information and a different route.
Stated purpose: identify an appropriate business route for a specific scheduling-service enquiry.
Proposed data: company-level operations context plus individual contact details.
Alternative: use an approved company enquiry channel and limited professional-role research.
Evidence gap: no established need for personal mobile enrichment.
Impact concern: unexpected contact through a channel the individual did not supply.
Design decision: remove personal-mobile enrichment and hold the outreach plan for its separate channel assessment.
The example is synthetic and does not determine a lawful basis. It shows an assessment changing the activity rather than merely blessing the original design.
Make safeguards operational
If the reviewer approves a bounded activity, specify how restrictions will be enforced. Relevant controls might include limited fields, restricted access, clear source information, a defined retention review, current suppression checks, and human review of uncertain matches. A safeguard mentioned in a document but absent from the system should not count as implemented.
Identify who verifies each control and what evidence demonstrates it works. For example, a test can show that an opted-out synthetic record cannot enter the promotional queue. That test supports the control's operation, not the entire legal conclusion.
Do not use a completed assessment as permission for a new brand, channel, purpose, or data category. Link the CRM label to the actual activity and assessment version so later users can see its boundaries.
Review when material facts change, not only when an annual reminder appears. New sources, complaints, unexpected effects, provider changes, or revised guidance can require reconsideration.
The final record should explain why the activity is supported or not supported, what evidence was considered, which safeguards exist, and what would change the decision. A checkbox becomes useful only when it points to that accountable reasoning rather than replacing it.
If you are also choosing research access, ask about Leads Automation’s independent Sales Navigator offer at US$15/month on WhatsApp. Confirm the available plan, eligibility and terms before ordering; this is not LinkedIn’s official price or an assurance that any particular integration is included.