Lawful basis and processing restriction

Forums
GDPR compliance has been a topic for years, and many threads on the forum cover slices of the issue.

Related:
https://forum.mautic.org/t/rfc-improving-mautics-gdpr-compliance-cookie-management/27801
https://forum.mautic.org/t/gdrp-let-user-delete-its-mautic-contact/30556
https://forum.mautic.org/t/are-these-things-possible-any-idea-of-how-gdpr-compliance-of-mautic/17922
https://forum.mautic.org/t/field-level-security/26537

Problem
Mautic only knows one kind of permission: can I email this person or not (Do Not Contact, and it works per channel). It has no idea what a lawful basis for processing is (GDPR Art. 6), and there's no way to stop using someone's data without deleting it (Art. 18).

this means:

- A contact who withdraws consent is still in segments, still scored, still tracked and still moving through campaigns. Some examples:

https://forum.mautic.org/t/contact-doesnt-gets-removed-from-segment-when-he-unsubscribed/21938
https://forum.mautic.org/t/do-not-contact-on-preference-page/23391
https://forum.mautic.org/t/rfc-improving-mautics-gdpr-compliance-cookie-management/27801 (cookies are still set for DNC contacts)

- Restricting processing isn't possible. You either delete data you may need to keep (a dispute, for example) or you keep using data you shouldn't.

- The only place to record consent is a custom field, like the "GDPR opt-in" boolean. One yes/no can't tell if you're processing someone because of consent, a contract or a legal obligation.

- DNC can be undone by a form action, the API or an import, and nothing asks why: https://forum.mautic.org/t/remove-dnc-from-contact-if-they-submit-a-new-form/33461 https://forum.mautic.org/t/unsubscribe-do-not-contact-contain-a-lot-of-problems/23701 https://github.com/mautic/mautic/issues/9027

Not having a lawful basis is one of the most common reasons for GDPR fines. The CMS Enforcement Tracker Report 2025 counts 669 of them, around 30% of the fines with full information. HubSpot already has a lawful basis property per contact (https://knowledge.hubspot.com/contacts/how-can-i-track-lawful-basis-of-processing-in-hubspot). There's no open source option doing the same.

Solution
I'd like every contact to have a lawful basis for processing, and Mautic to respect it everywhere. When a contact has no basis left, it becomes restricted: the data stays stored, but no feature can use it.

Phase 1, separate processing from communication. A new "Legal basis for processing" field on each contact (nullable, multiple choice): legitimate interest (lead, customer, other), performance of a contract, legal obligation, vital interests, public task, freely given consent, not applicable. Only a role with its own permission (DPO or admin) can change it, single or bulk. I'd also add an age confirmation field, visible only to permitted roles, plus control over what sensitive fields go out in form results and exports.

Phase 2, collect and withdraw. Processing becomes an option in the preference center, next to the marketing and tracking controls. Withdrawing removes only "consent" from the legal basis and leaves the others in place. So if there's also a contract, the contact can't turn that off by removing consent.

Phase 3, enforce. Empty legal basis means restricted. Segments stop counting the contact, campaigns skip it, and scoring, tracking, exports, sends and form actions stop. Same for the API, imports, integrations and background jobs. The restricted status shows on the profile and there's a filter in the contact list. There's a bulk action to delete restricted contacts, and the restriction connects to the GDPR cleanup cron, with a retention time you can configure.

For migration, existing contacts start with an empty basis, since we can't guess it. Enforcement is a setting that a permitted role turns on after seeing how many contacts have no basis, so nobody gets restricted overnight. New installs ship with it on.

Alternatives
Subscription of proprietary solutions since no open source alternative can fully address everything I mentioned above.

Impact
Yes. It adds two new pieces of personal data per contact: the legal basis and the age confirmation. Both are sensitive, so only roles with permission can see or export them. Nothing else new is collected.

Who benefits: public bodies, political organizations and anyone moving away from proprietary software for digital sovereignty reasons. And the contacts themselves, because withdrawing consent would stop processing, not just emails.

Funding

Looking for funding. The full scope is EUR 49,920. We estimate about 6 months (13 sprints of 2 weeks), including community feedback, code review and merging. The cost is EUR 49,920: a senior developer at 0.5 WTE and a design engineer at 0.7 WTE, EUR 40/hour.