One of six GDPR Art. 6 grounds that must apply for personal data processing to be lawful.
GDPR Art. 6(1) enumerates six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Controllers must identify and document the lawful basis for each processing activity, and inform data subjects of it in the privacy notice.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.