Lawful basis for processing

The PDP Law names several bases that can make processing personal data lawful, including valid and explicit consent, performance of a contract with the data subject, the controller's legal obligation, protection of vital interests, a task in the public interest or under official authority, and other legitimate interests that take the data subject's rights into account. Every processing activity needs its own basis, and that basis is recorded. Check the list and its conditions in the official text; this is not legal advice.