Processing can only be considered lawful if a legal basis for processing applies. Legal bases are specified by Article 6(1) GDPR. See also: Lawful processing of personal data.