eu-gdprlisted

# EU GDPR — product-side playbook GDPR isn't legal-only homework — it shapes product. Lawful basis dictates data flows, Article 22 affects AI-decision UX, DPIA is mandatory for high-risk processing. Treating GDPR as a Phase 2 retrofit produces unshippable products in the EU. ## 1. The 6 lawful bases — pick exactly one per processing activity | Basis | When to use | Risk | |---|---|---| | Consent | User actively agrees; freely-given, specific, informed | Easy to do wrong; consent fatigue | | Contract | Necessary to perform the contract user requested | Misused for "we want to" | | Legal obligation | Required by law | Narrow; cite the specific law | | Vital interests | Life-or-death | Very narrow | | Public task | Public-sector only | N/A for most fintechs | | Legitimate interests | Your interest, balanced against user's rights | The "we have a good reason" basis; needs balancing test (LIA) | **Common PM mistake**: using "consent" for processing the user can't reasonably refuse (i.e. core product). That's not freely-given consent; use contract or LI instead. ## 2. Consent UX — what passes - **Granular**: separate consent per processing purpose (no bundling). - **Pre-ticked boxes**: forbidden. - **Cookie banners**: NOT a substitute for valid consent. - **Withdrawal must be as easy as giving**: one click in, one click out. - **Specific to purpose**: "We use your data to provide the service" = too vague. **PM rule**: design the consent UX once for GDPR. CCPA/DPDP can ride