Lawful Basis is the legal foundation required to process personal data under GDPR. Organisations must have at least one lawful basis before collecting or processing any personal data. GDPR Article 6 lists six possible lawful bases.
The six lawful bases are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Each basis has specific requirements and conditions. Organisations must clearly communicate which basis they rely on to data subjects.