Lawful basis
The legal reason you are allowed to process someone's data at all. Under GDPR you pick one of six, before you collect, not after.
See it
What it is
GDPR Article 6 says you may not process personal data unless one of six justifications applies: consent, performance of a contract, legal obligation, vital interests, public task, or legitimate interests. You pick one per purpose, write it down before you start, and disclose it in your privacy policy. Sending an order confirmation runs on contract. Keeping the invoice as long as your tax authority demands runs on legal obligation. The marketing newsletter usually runs on consent, but check before you assume it: the electronic-marketing rules are national, and several countries carve out existing customers or B2B contacts, so the GDPR basis and the ePrivacy permission get assessed as two separate questions. Fraud detection and basic security logging usually run on legitimate interests.
Teams reach for consent by reflex, and it is the weakest option. Real consent must be freely given, specific, informed, unambiguous, given by a clear affirmative act, and as easy to withdraw as it was to give. Pre-ticked boxes fail. Bundling it into your terms of service fails. And the moment a user withdraws it, your basis evaporates and you have to stop. Legitimate interests is sturdier but has a price: you must run and record a balancing test, the legitimate interest assessment, weighing your purpose against what the user would reasonably expect.
Gotcha: you cannot retroactively relabel processing when the first basis collapses. Asking for consent to analytics, getting a no, then quietly claiming legitimate interests for the same processing is one of the most reliably punished moves in European enforcement. The narrow exception is a genuine change in what you are doing: a new purpose can rest on a new basis if that basis holds up on its own, gets documented, and gets told to the user before you rely on it. Second gotcha: cookies live under a separate rule (the ePrivacy Directive), so any non-essential cookie or local storage write needs consent regardless of which basis covers the data underneath it.
Ask AI for it
Build a lawful basis register for this product. Go through the code and list every distinct processing purpose (account creation, order fulfilment, transactional email, marketing email, product analytics, session replay, ad retargeting, fraud checks, support tickets, error monitoring, AI features). For each one produce a row with: the purpose in one plain sentence, the personal data used, the Article 6 basis (consent, contract, legal obligation, vital interests, public task, legitimate interests) with a one-line justification, whether any special category data is involved and the extra Article 9 condition, the retention period, and the recipients. Where the basis is consent, specify how consent is captured, how it is stored as evidence (who, when, what version of the notice), and how withdrawal propagates so processing actually stops. Where the basis is legitimate interests, draft the balancing test: our interest, necessity, impact on the user, user expectations, and safeguards. Flag every purpose currently running with no defensible basis.