How to demonstrate lawful processing under GDPR Article 6?

GDPR Article 6 requires that every processing activity involving personal data has a lawful basis. For email marketing, you can't just collect addresses and send. You need to be able to say specifically: "I'm processing this person's data under [basis], and here's why that applies."

The two bases most relevant to email marketers:

Consent (Article 6(1)(a)): The person agreed. To use this, you need explicit, freely given, specific, and informed consent. and you need to be able to prove it. This is the basis for marketing emails when someone opted in to receive them. It requires documented consent records and the ability to withdraw it easily.

Legitimate interest (Article 6(1)(f)): You have a legitimate reason to process the data, and it doesn't override the individual's rights. For email, this can cover certain B2B communications, follow-ups to existing customers, or service-related messaging. It requires a Legitimate Interest Assessment (LIA). a documented balancing test showing your interest outweighs the subscriber's privacy interests. You can't just claim legitimate interest without doing that analysis.

Other bases exist (contractual necessity, legal obligation, vital interests, public task) but are rarely the right fit for marketing email.

To demonstrate lawful processing in practice:

• Document your lawful basis for each processing activity in a records-of-processing document (required for most organizations under GDPR Article 30)
• For consent-based processing: maintain the consent records
• For legitimate interest: maintain the LIA
• Be able to answer "which basis applies to this email?" for every campaign type you run

If you can't map each email type to a specific basis, that's the gap to close first. For the consent documentation side of this, see how to prove consent in an audit.