Lawful basis for processing (GDPR)

GDPR Article 6 provides that personal data may only be processed if at least one of six lawful bases applies: the person's consent; performance of a contract; a legal obligation; protecting vital interests; a task in the public interest; or the controller's legitimate interests, provided the person's rights do not override them.

Choosing correctly matters because it shapes everything else: consent can be withdrawn; legitimate interests require a documented balancing test and the person can object. And you cannot switch bases mid-processing to "rescue" a use.

In AI the typical question is which basis covers training or using a model with customer or employee data. There is no single answer: it depends on the purpose, and it must be documented in the record of processing.