Each data collection point documents its lawful basis

GDPR Art. 6 prohibits all personal data processing without a lawful basis — there are only six valid bases (consent, contract, legitimate interest, legal obligation, vital interests, public task), and mixing them up is not a technicality. If you send marketing emails claiming "contract" as the basis because you have the email from signup, that is a direct GDPR violation. LGPD Art. 7 imposes the same requirement for Brazilian users. Without documented lawful bases, the business cannot respond coherently to a data subject access request, a supervisory authority inquiry, or a lawsuit. ISO-27001:2022 A.5.34 requires organizations to identify and apply the correct legal basis as part of privacy governance.

Map lawful bases in a data register. This does not require code changes — a documented record satisfies the regulatory obligation.

Data Register (data-register.md or spreadsheet):

| Data Type     | Collection Point  | Lawful Basis     | Notes                              |
|---------------|-------------------|------------------|-------------------------------------|
| Email         | Signup form       | Contract         | Required to deliver service        |
| Email         | Newsletter opt-in | Consent          | Separate checkbox; opt-out in every email |
| Usage events  | In-app analytics  | Legitimate int.  | Balancing test: pseudonymous, low impact |
| Payment info  | Checkout          | Contract         | Required for payment processing    |
| IP address    | Server logs       | Legal obligation | 90-day retention; security use only |

For legitimate interest claims, include a brief balancing test: what is the business purpose, what is the privacy impact, and why the interest is not overridden by user rights. Add this register to your GDPR Art. 30 Records of Processing Activities (ROPA) filing.