Privacy policy mentions GDPR but doesn't disclose lawful basis for processing

Under GDPR (General Data Protection Regulation), every use of personal data needs a named legal justification, called a lawful basis, such as consent, contract, or legitimate interest. This check looks for whether the privacy policy names GDPR at all, and if so, whether it also states the lawful basis for each way the business uses personal data. On this site, GDPR is mentioned, but no lawful basis is disclosed. GDPR Article 6 requires an explicit lawful basis for processing, one of consent, contract, legal obligation, vital interests, public task, or legitimate interests. A policy that name-drops GDPR without stating which basis applies to which activity is considered non-compliant, and it's a common gap because many bespoke, hand-written policies miss it even when template-based ones don't. Your privacy lawyer should add a 'Lawful Basis' section listing each processing activity and its basis, for example 'We process your email for newsletter signups based on your consent' or 'We process billing data based on contract necessity.' This typically takes about a day working with a privacy lawyer, since it requires reviewing each real data use the business has.