Under Article 6 of GDPR, there are six legal bases for data processing. Consent is only one of them,
and processing is not always dependent on obtaining consent.
Option B is correct because GDPR does not require consent for all processing activities; processing
can also be based on contractual necessity, legal obligations, vital interests, public tasks, or
legitimate interests.
Option A is incorrect because contractual necessity is a valid legal basis for processing.
Option C is incorrect because vital interests (e.g., processing in medical emergencies) are a valid legal
basis.
Option D is incorrect because legitimate interests can justify processing, provided they do not
override the rights of data subjects.
Reference:
GDPR Article 6(1) (Lawfulness of processing)
Recital 40 (Processing should be lawful and justified)
