Lawful basis
Personal data is processed only under a recorded Consent or another lawful basis tied to a Purpose.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 P2.1 | The entity communicates choices about the collection, use, retention, disclosure and disposal of personal information, and obtains consent. |
| SOC2 P3.1 | The entity collects personal information consistent with its privacy objectives. |
| SOC2 P3.2 | The entity obtains explicit consent where it is required, and communicates the consequences of refusing. |
| SOC2 P6.1 | The entity discloses personal information to third parties only with the data subject’s consent. |
| GDPR Art.6 | Processing is lawful only on a stated basis, such as consent, contract, legal obligation or legitimate interest. |
| GDPR Art.7 | A controller shows that consent was given, and withdrawing consent takes no more effort than giving it. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action that reads or writes a personal field in the report period. |
| Assert | Each cites a Purpose with a recorded Consent or lawful basis in force at that moment. |
Owner
Example
A newsletter Play wants to email a list of 2,000 Contacts. Only the 1,140 with recorded Consent for the marketing Purpose receive it.