2. Processing requires a basis

The lawfulness of processing is one of the principles of data protection. It means that the processing of personal data always requires a basis in law.

The basis for processing must be chosen before the start of processing. Personal data can be processed on more than one basis. But after a basis has been specified for processing, it can no longer be changed. If there is no statutory basis for the processing of personal data, it is illegal. The processing basis affects things like the data protection rights available to the data subject.