Under the GDPR, a lawful basis is a valid purpose for processing personal data. The GDPR offers 6 lawful bases.