Data privacy laws in the UK (GDPR) mean that to process personal information about an individual, companies must choose a lawful basis before they do so. There are six bases to choose from, as defined by the Information Commissioner’s Office (ICO). Deciding which basis is most appropriate to use will depend on the purpose and relationship with the individual.