A reference to GDPR Article 6, which requires an organization to base its collection and use of data on 1 of 6 legal bases. The most common legal bases are performance of a contract and legitimate interests of the organization.