GDPR legal basis capture and consent workflow on EU form submission

Outcome. EU-region contacts without a confirmed legal basis for marketing processing are held back from marketing sends and flagged for review, instead of silently entering nurture with no documented consent.

flowchart TD
    A[Contact created or legal basis changes] --> B{Country in EU/EEA/UK list?}
    B -->|No| Z[No action]
    B -->|Yes| C{Legal basis blank or unknown?}
    C -->|Yes| D[Hold from marketing / non-marketing]
    D --> E[Add to EU consent review list]
    E --> F[Notify marketing ops/compliance]
    F --> G[Create review task, due +2 business days]
    C -->|No| H{Legal basis = Legitimate interest?}
    H -->|Yes| I[Set annual review date]
    H -->|No, valid consent| J[Remove from review list, proceed]

When to use it / when not to

• Use when you sell into the EU/EEA/UK and your forms are configured with GDPR options (legal basis for processing, consent-to-process, consent-to-communicate, or legitimate interest).
• Use this as a downstream compliance gate that reacts to what your forms already captured, not as the mechanism that captures consent itself. Legal basis and consent checkboxes are configured on the form and in account-level Privacy & Consent settings; a workflow cannot create consent that was never collected. (check in your portal: Settings > Privacy & Consent shows data privacy settings turned on, and each intake form has its GDPR options enabled)
• Do not use this to replace a Data Processing Agreement or legal review of your consent language. This is an operational safety net, not legal advice.
• Do not apply it to non-EU contacts unless your policy applies GDPR-equivalent rules globally. Scope the country filter to your actual policy.