unified
UC-DATA-01 — Process personal data only under a documented lawful basis
Identify and document the lawful basis and organizational authority for each personal-data processing activity before data is collected or processed. Record the basis (e.g., consent, contract, legal obligation, legitimate interest) in the processing register and collect personal data only for those documented purposes. Review the register at least annually and whenever processing changes.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Data Protection & Privacy
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-DATA-01
- title
- Process personal data only under a documented lawful basis
- statement
- Identify and document the lawful basis and organizational authority for each personal-data processing activity before data is collected or processed. Record the basis (e.g., consent, contract, legal obligation, legitimate interest) in the processing register and collect personal data only for those documented purposes. Review the register at least annually and whenever processing changes.
- domain
- Data Protection & Privacy
- control_type
- preventive
- control_category
- administrative
- members
- framework
- nist-800-53
- control_id
- PT-2
- coverage
- full
- relationship
- superset_of
- framework
- soc2
- control_id
- P3.1
- coverage
- partial
- delta
- fair collection methods and reliable data sources (with collection transparency delivered by the privacy-notice companion), beyond documented lawful basis and purpose limitation
- relationship
- intersects_with
- framework
- gdpr
- control_id
- GDPR-Art6
- coverage
- full
- relationship
- superset_of
- guidance
Source
No record-specific source URL is provided.
Connections
- Privacy Program Operations (Consent, Complaints & Sharing) operates UC-DATA-01 — Process personal data only under a documented lawful basis
- SOC 2 Privacy Criteria Assessment tests UC-DATA-01 — Process personal data only under a documented lawful basis
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Undocumented data inventory and unmapped data flows
- strength
- primary
- rationale
- Maintaining and annually reviewing a processing register creates the authoritative record of processing activities and purposes the risk says is missing.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Illegal processing of personal or sensitive data
- strength
- primary
- rationale
- Documenting a lawful basis and authority before any collection/processing directly prevents processing without legal authority or consent.
- UC-DATA-01 — Process personal data only under a documented lawful basis maps_to P3.1 — Personal information is collected consistent with the entity's objectives related to privacy.
- framework
- soc2
- control_id
- P3.1
- coverage
- partial
- delta
- fair collection methods and reliable data sources (with collection transparency delivered by the privacy-notice companion), beyond documented lawful basis and purpose limitation
- relationship
- intersects_with
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-01 — Process personal data only under a documented lawful basis maps_to GDPR-Art6 — Lawfulness of processing
- framework
- gdpr
- control_id
- GDPR-Art6
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Regulation (EU) 2016/679
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-01 — Process personal data only under a documented lawful basis maps_to PT-2 — Authority to Process Personally Identifiable Information
- framework
- nist-800-53
- control_id
- PT-2
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- Recording the lawful basis in a register removes the 'missing lawful-basis documentation' driver of regulatory fines and private actions.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Excessive collection, purpose creep and secondary use
- strength
- related
- rationale
- Collecting personal data only for the documented purposes constrains over-collection and purpose creep at the point of collection.