Every processing of personal data in your organization must rest on one of the legal bases. Without a legal basis, the processing is not lawful. The six legal bases are: consent, contract, legal obligation, protection of vital interests, a task carried out in the public interest or in the exercise of official authority, and legitimate interests.