A privacy notice explains categories of data and retention but never states the lawful basis for each processing purpose. Which required element is missing?
Select an answer to reveal the explanation.
Short Explanation
People should know not only what you collect but on what legal ground. Skipping the lawful basis leaves a hole in the Art. 13/14 checklist—even if categories and retention look complete.
Full Explanation
Where personal data are collected from the data subject, Article 13 requires information about the legal basis for processing; Article 14 imposes parallel duties for indirect collection. For special-category data, the relevant Article 9 condition should also be explained. A notice that covers categories and retention but never states the lawful basis for each purpose therefore omits a mandatory element. People interacting with municipal or commercial services cannot assess fairness or exercise informed choices without knowing why the processing is claimed to be lawful.
Cloud-region marketing slogans, open-source library footers, and commissioners’ signatures are not substitutes for Article 6 (and Article 9) disclosures.
Exam caveat: map bases per purpose rather than listing every Article 6 letter once globally if different purposes use different bases. Consent-based purposes should also explain withdrawal; legitimate-interest purposes should mention objection rights.
Operational check: add a purpose-to-basis table in the notice (or clear per-section statements), mirror it in the RoPA, and QA that no live purpose lacks a stated basis—especially new features shipped after the last notice edit.