Lawful bases explained</strong> </i> <p>GDPR requires controllers of personal data to check they have a lawful basis for their processing of personal information, and to explain which lawful bases they are using for specific uses of personal information.