EDPB: Process personal data lawfully - Data Protection guide for small business

Data controllers need to rely on a “legal basis” in order to process personal data lawfully. It is essential to identify the appropriate legal basis as it may come with specific requirements (e.g. consent must be free, specific, informed and unambiguous) and have consequences on individuals’ rights (e.g. the right to portability only applies when the legal basis is consent or a contract).

On this page, you will find more information on the different legal bases under the GDPR. Find out more about the rights that apply per legal basis.

https://edpb.europa.eu/sme-data-protection-guide/process-personal-data-lawfully_en