Right away. This is one of the fundamental cornerstones of GDPR.
You will be in breach of the GDPR if you did not clearly identify the appropriate lawful basis (or bases, if more than one applies) from the start.
The GDPR brings in new accountability and transparency requirements. You should therefore make sure you clearly document your lawful basis so that you can demonstrate your compliance.
You must ensure that you include it in all future privacy notices.
You must determine your lawful basis before you begin processing, and you should document it.
Your privacy notice should include your lawful basis for processing as well as the purposes of the processing.
If you are processing special category data you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.
