When personal data is to be processed, the rules for personal data processing in the GDPR must be followed. The starting point is that all personal data processing is prohibited if it does not have a legal basis. When the legal basis for personal data processing is determined and documented, other requirements of the GDPR must be met, for example the basic principles of data protection and informing the persons who will have their personal data processed (about the processing).