# Lawful basis

URL: /systems/trust-and-governance/controls/lawful-basis · Id: `control:lawful-basis`

> Personal data is processed only under a recorded Consent or another lawful basis tied to a Purpose.

Personal data is processed only under a recorded [Consent](/business/nouns/consent) or another lawful basis tied to a [Purpose](/business/nouns/purpose).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 P2.1](/systems/trust-and-governance/criteria/soc2/p2-1) | The entity communicates choices about the collection, use, retention, disclosure and disposal of personal information, and obtains consent. |
| [SOC2 P3.1](/systems/trust-and-governance/criteria/soc2/p3-1) | The entity collects personal information consistent with its privacy objectives. |
| [SOC2 P3.2](/systems/trust-and-governance/criteria/soc2/p3-2) | The entity obtains explicit consent where it is required, and communicates the consequences of refusing. |
| [SOC2 P6.1](/systems/trust-and-governance/criteria/soc2/p6-1) | The entity discloses personal information to third parties only with the data subject’s consent. |
| [GDPR Art.6](/systems/trust-and-governance/criteria/gdpr/art-6) | Processing is lawful only on a stated basis, such as consent, contract, legal obligation or legitimate interest. |
| [GDPR Art.7](/systems/trust-and-governance/criteria/gdpr/art-7) | A controller shows that consent was given, and withdrawing consent takes no more effort than giving it. |

## Implemented by
- [Privacy](/workflows/processes/privacy)
- [Privacy](/systems/privacy)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action that reads or writes a personal field in the report period. |
| Assert | Each cites a Purpose with a recorded Consent or lawful basis in force at that moment. |

## Owner
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

## Example
A newsletter [Play](/business/nouns/play) wants to email a list of 2,000 [Contacts](/business/nouns/contact). Only the 1,140 with recorded Consent for the marketing Purpose receive it.