The classic trap
Recital 40 lays down the principle that the CNPD and CNIL enforce relentlessly: no processing is lawful without a legal basis identified and documented in advance. In practice, audits show that organisations mix legal bases (consent + legitimate interest for the same processing), switch basis mid-way, or invoke contract performance for marketing activities. The result is that the entire processing becomes unlawful, and the EDPB reminds in guidelines 5/2020 and 2/2019 that you cannot retroactively switch legal basis to fix a non-compliance.
The 6 legal bases of Article 6 and their pitfalls
- Consent (6.1.a): freely given, specific, informed, unambiguous, revocable at any time. Unusable in employer-employee relationships according to the EDPB.
- Contract performance (6.1.b): strictly limited to data necessary to perform the contract. Billing yes, marketing profiling no.
- Legal obligation (6.1.c): the law must be clear, precise and foreseeable. Best practice or sectoral usage are not enough.
- Vital interests (6.1.d): reserved for life-or-death situations, not a catch-all.
- Public interest task (6.1.e): reserved for the public sector or explicit delegations.
- Legitimate interest (6.1.f): requires a documented 3-step balancing test (LIA), unavailable to public authorities in the performance of their tasks.
Recital 40 imposes a simple discipline: one purpose = one legal basis = one documentation set. The common pitfall is to record in the Article 30 register a generic legal basis (legitimate interest) without having run the balancing test, or to tick consent when the data subject had no real choice.
How Luxgap automates this risk
Our Luxgap Lawful Basis Mapper eliminates the grey zone around legal bases by automatically assigning the right basis to each processing activity in your register, with a CNPD-ready justification. The tool queries your connected systems (Odoo, M365, Salesforce, HR Suite, Sage BOB 50) to identify each real purpose, then maps it against the EDPB framework and CJEU case law to suggest the most defensible basis, not the most convenient one.
- Detects each new processing purpose as soon as a workflow appears in Odoo, Salesforce or M365, without waiting for the annual register review.
- Runs the documented 3-step legitimate interest assessment (LIA), with weighting of data subject rights, opposable during an audit.
- Sends instant Teams or email alerts when a marketing processing relies on contract performance, the most frequently sanctioned mistake by CNIL and CNPD.
- Generates a timestamped consent register, with cryptographic proof of the moment the box was ticked, compliant with EDPB guidelines 5/2020.
- Produces a sealed lawfulness audit PDF, demonstrating that each processing relies on a real and pre-documented legal basis, respecting the spirit of Recital 40.
- Blocks retroactive changes of legal basis, a practice sanctioned by the CJEU and the EDPB.
Available as part of a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual processing activities, with a free 48-hour blind audit to measure how many of your processings currently rely on a fragile legal basis.
