{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-01","description":"Identify and document the lawful basis and organizational authority for each personal-data processing activity before data is collected or processed. Record the basis (e.g., consent, contract, legal obligation, legitimate interest) in the processing register and collect personal data only for those documented purposes. Review the register at least annually and whenever processing changes.","details":{"control_category":"administrative","control_type":"preventive","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"PT-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"P3.1","coverage":"partial","delta":"fair collection methods and reliable data sources (with collection transparency delivered by the privacy-notice companion), beyond documented lawful basis and purpose limitation","framework":"soc2","relationship":"intersects_with"},{"control_id":"GDPR-Art6","coverage":"full","framework":"gdpr","relationship":"superset_of"}],"statement":"Identify and document the lawful basis and organizational authority for each personal-data processing activity before data is collected or processed. Record the basis (e.g., consent, contract, legal obligation, legitimate interest) in the processing register and collect personal data only for those documented purposes. Review the register at least annually and whenever processing changes.","title":"Process personal data only under a documented lawful basis","unified_id":"UC-DATA-01"},"id":"uc:UC-DATA-01","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-01","sourceIds":["gdpr","nist-800-53","soc2"],"sourceUrl":null,"title":"UC-DATA-01 — Process personal data only under a documented lawful basis","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:18d6cc80a349d300c05823a14b28e80608d27dd2e79525a2a0fa51a13d12088c","properties":{},"sourceDetailPath":"/data/v1/records/wf-r9-636a9e6e.json","sourceId":"wf:R9","targetDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","targetId":"uc:UC-DATA-01","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35078c47674cd8be94bea9053eb864225c5650de45a706654a0186f5f77ee149","properties":{},"sourceDetailPath":"/data/v1/records/wf-d22-f1c724b8.json","sourceId":"wf:D22","targetDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","targetId":"uc:UC-DATA-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3dbe3964977b4cc816ce754ffec4cea6127c59fb731a7a2e69d01a9587f38f1e","properties":{"rationale":"Maintaining and annually reviewing a processing register creates the authoritative record of processing activities and purposes the risk says is missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f367deff479d4c7d614528c2f1da4f9d912acd4b95c869949e83fbfcbcef805","properties":{"rationale":"Documenting a lawful basis and authority before any collection/processing directly prevents processing without legal authority or consent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:671d1a835fdf4dcf0e0cf81c0cc9c30b30ef94d396cc882ea025bedb22db4e3e","properties":{"control_id":"P3.1","coverage":"partial","delta":"fair collection methods and reliable data sources (with collection transparency delivered by the privacy-notice companion), beyond documented lawful basis and purpose limitation","framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/ctrl-soc2-p3-1-b9d27fd7.json","targetId":"ctrl:soc2:P3.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6ea2241cc7573102a2aa155e24e4f6d70ec70c02aab173cecabbec89872ced48","properties":{"control_id":"GDPR-Art6","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art6-cbe66aa0.json","targetId":"ctrl:gdpr:GDPR-Art6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8398bc7a117fc50620bda6b1d6500f40f83a29b26ceb651461a6f3e8e4da15e1","properties":{"control_id":"PT-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pt-2-f0f2ec78.json","targetId":"ctrl:nist-800-53:PT-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:88ce1cc28f79db491c622197df631497ee89a669b669c4d16605501f16ebc046","properties":{"rationale":"Recording the lawful basis in a register removes the 'missing lawful-basis documentation' driver of regulatory fines and private actions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:baaaaa8d759ae4bf52b2d5f55d12b851386e7e17eba2c7717b63e8850555e773","properties":{"rationale":"Collecting personal data only for the documented purposes constrains over-collection and purpose creep at the point of collection.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"}],"schemaVersion":1}