# ISO/IEC 27701 A.1.2.3 — Identify lawful basis

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27701_a123_f13a23c23a-isoiec-27701-a123-identify-lawful-basis
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27701 (Privacy Information Management)](https://support.icompaas.com/support/solutions/c_gen_iso27701) › [Conditions for collection and processing](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27701_conditionsforcollectionandprocessing)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27701 · Control A.1.2.3 · Priority: high · Component: Conditions for collection and processing

### What this control covers

The organization shall determine, document and be able to demonstrate compliance with the relevant lawful basis for processing PII. Implementation: Record lawful basis per processing activity; update when purpose changes. Justification: Needed to demonstrate lawfulness per jurisdiction.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Focus: Identify lawful basis.

### Quick checklist

-   Implement — Identify Lawful Basis
-   Document — Identify Lawful Basis
-   Record — Identify Lawful Basis

### Related articles on this site

-   [5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment](https://support.icompaas.com/support/solutions/articles/62000219858-5-2-2-ensure-that-activity-log-alert-exists-for-delete-policy-assignment)
-   [Ensure that Activity Log Alert exists for Create or Update Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219859-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group)
-   [5.2.5 Ensure that Activity Log Alert exists for Create or Update Network Security Group Rule](https://support.icompaas.com/support/solutions/articles/62000219862-5-2-5-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group-rule)
-   [Ensure that Activity Log Alert exists for Create or Update Security Solution](https://support.icompaas.com/support/solutions/articles/62000219868-ensure-that-activity-log-alert-exists-for-create-or-update-security-solution)