Provenance includes consent context

GDPR Art. 6 requires a lawful basis for every contact's personal data processing — and that basis must be determinable from the record itself, not from institutional memory. Art. 13 requires that data subjects be told the legal basis at the time their data is collected. Without a legal_basis indicator on the provenance record, you cannot demonstrate compliance per-contact or automate consent-status checks. A scraping operation categorized as 'legitimate interest' needs different treatment than a form submission with explicit consent — conflating them because the record carries no basis indicator is a regulatory failure waiting to happen.

Add a legal_basis column to the contacts table and populate it at ingestion time based on source type. The value should map directly to one of the GDPR Art. 6 lawful bases.

ALTER TABLE contacts
  ADD COLUMN legal_basis TEXT
    CHECK (legal_basis IN (
      'consent',
      'legitimate_interest',
      'contract',
      'legal_obligation'
    ));

In the ingestion pipeline, derive the value from source_type:

const LEGAL_BASIS_BY_SOURCE: Record<string, string> = {
  form:       'consent',
  referral:   'consent',
  api:        'legitimate_interest',
  scraper:    'legitimate_interest',
  purchased:  'legitimate_interest',
}
const legal_basis = LEGAL_BASIS_BY_SOURCE[source.source_type]

For sources where 'consent' applies, the provenance record should also carry a reference to the consent version in effect at ingestion time.