The General Data Protection Regulation makes it illegal to process personal data unless at least one of the lawful bases for processing is satisfied. This is called ‘conditions for processing’ under the currently valid Data Protection Directive. But, the provisions are not the same and you should acquaint yourself with the changes.