In summary, GDPR requires that personal data must be processed lawfully, and there are six lawful bases for processing. At least one of these must apply in order for GDPR to be complied with.