The choice of lawful basis depends upon: Purposes The context of processing The data controllers should do following before the start of processing of personal data: Identify the lawful basis Document the lawful basis If you find that your lawful basis is invalid under GDPR, this will lead to the breach of accountability and transparency principle.