Under GDPR, one of six legal grounds that must exist before processing personal data: consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. AI systems often rely on legitimate interests (requiring a balancing test) or consent (requiring clear, specific, freely-given agreement). Training on personal data, inference processing, and service improvement uses may each require separate lawful basis analysis.