Lawful bases for processing The General Data Protection Regulation, Regulation (EU) 2016/679, Art 6(1) (GDPR), sets out six legitimate bases for the processing of personal data and to comply with the lawfulness, fairness and transparency principle (set out in GDPR, Regulation (EU) 2016/679, Art 5(1)(a)) at least one of these six conditions must be met. These conditions include: • consent—ie the data subject has given consent to the processing of their personal data for one or more specific purposes (GDPR, Regulation (EU) 2016/679, Art 6(1)(a)) • performance of a contract—ie the processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract (GDPR, Regulation (EU) 2016/679, Art 6(1)(b)) • compliance with a legal obligation—ie the processing is necessary for compliance with a legal obligation