GDPR Art.5.1a: Lawfulness, Fairness and Transparency

Start with a thorough data mapping exercise. Identify every processing activity across your organisation - what personal data flows where, for what purpose, and who touches it along the way. Do not skip departments like marketing or HR; they are often where the gaps hide. For each processing activity, pin down the right legal basis from Article 6(1) and document your reasoning. If you rely on consent, make sure it meets Article 7 standards: freely given, specific, informed, and unambiguous. If you rely on legitimate interests, write up a proper Legitimate Interest Assessment (LIA) that honestly weighs your interests against the individual's rights. Build layered privacy notices that comply with Articles 13 and 14. Put a short, readable summary at the point of collection, then link to the full policy with all the required details. Write them in plain language. If your grandmother would not understand the notice, rewrite it. Set up a review cycle. When you launch a new product feature, onboard a new vendor, or change how you use data, your legal bases and privacy notices need updating too. Keep version histories and records of how and when you communicated changes to data subjects. Train your team. Everyone who handles personal data should know which legal basis applies to what they do and how to handle questions from data subjects. Create a clear escalation path for situations where someone is not sure whether a processing activity is lawful.