Processing personal data lawfully means that an organization or person must have a valid legal reason, called a "lawful basis," to collect, use, or share personal data. The processing must comply with laws such as the GDPR which require that personal data be handled fairly, transparently, and for specific purposes authorized by law. Without a lawful basis, processing personal data is illegal. The most commonly recognized lawful bases for processing include:

• Consent: The individual has given clear permission for their data to be processed.
• Contract: Processing is necessary for a contract with the data subject.
• Legal obligation: Processing fulfills a legal duty.
• Vital interests: Processing protects someone's life.
• Public task: Processing is needed to perform a public interest task or exercise official authority.
• Legitimate interests: The processor's legitimate interests outweigh the individual's rights, except for public authorities in official tasks.

Each time personal data is processed, the processor must identify and document which lawful basis applies to ensure compliance.