Privacy policy mentions GDPR but doesn't disclose lawful basis for processing
Under GDPR (General Data Protection Regulation), every use of personal data needs a named legal justification, called a lawful basis, such as consent, contract, or legitimate interest. This check looks for whether the privacy policy names GDPR at all, and if so, whether it also states the lawful basis for each way the business uses personal data. On this site, GDPR is mentioned, but no lawful basis is disclosed.
Why this matters
If GDPR applies to you, Article 6 requires a lawful basis for processing: consent, contract, legal obligation, vital interests, public task or legitimate interests. A policy that mentions GDPR without stating which basis applies to which activity may not meet the transparency requirements in Articles 13 and 14. Whether GDPR applies depends on where your visitors are, so check with a privacy adviser.
How to fix it
Your privacy lawyer should add a 'Lawful Basis' section listing each processing activity and its basis, for example 'We process your email for newsletter signups based on your consent' or 'We process billing data based on contract necessity.' This typically takes about a day working with a privacy lawyer, since it requires reviewing each real data use the business has.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit