← GDPR · Principles
Art.5(1)(a) — Lawfulness, fairness and transparency
critical
lawful-basisprivacy-notice
Requirement
Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
lawful basislegal basislawfullylegitimate interestconsentcontractcontractual
Required element 2 — any one of
transparen…privacy noticeinformfair
Supporting terms — specificity signals
article 6purposedisclosedplain languageaccessible
Contradiction markers
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
no lawful basis
not disclosed to users
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| SOC 2 | P1.1 | Notice and communication of privacy commitments | privacy-notice lawful-basis |
| ISO 27001 | A.5.34 | Privacy and protection of personally identifiable information | lawful-basis privacy-notice |
| CCPA/CPRA | 1798.100(a)-(b) | Notice at collection | privacy-notice |
| CCPA/CPRA | 1798.130(a)(5) | Privacy policy content and annual update | privacy-notice |
| CCPA/CPRA | 1798.135 | "Do Not Sell or Share" and "Limit the Use" links | privacy-notice |
| SOC 2 | CC2.3 | External communication | privacy-notice |
| GLBA | Reg P 1016.4-1016.6 | Initial and annual privacy notices | privacy-notice |
| COPPA | 312.4(d) | Online notice of children's information practices | privacy-notice |