Legal basis

Before processing individuals’ data, organisations must identify a legal basis under the GDPR. The GDPR lists six legal bases that may be relied on depending on the context in which this processing takes place: consent, performance of a contract, legal obligation, vital interests of an individual, public interest and legitimate interest.
The GDPR also establishes additional conditions for the processing of special categories of data: the processing of these types of data, due to their sensitivity, is generally prohibited except in specific cases.