What it asks for. Processing is lawful only if at least one of six bases applies: consent, performance of a contract, a legal obligation, protection of vital interests, a task in the public interest or official authority, or the legitimate interests of the controller or a third party, balanced against the rights of the individual. Public authorities cannot rely on legitimate interests for their tasks.
In practice. Each processing activity has a lawful basis chosen and documented before processing begins. Where legitimate interests is used, a documented balancing assessment is expected. Evidence includes the basis recorded in the record of processing activities, consent records where relevant, and privacy notices that state the basis. The chosen basis affects which rights apply, so it should be decided deliberately.
Common gaps. Organisations sometimes switch bases after the fact or rely on consent where it cannot be freely given, such as in employment. Legitimate interests assessments are often missing or superficial.