What do we need to tell people about our lawful basis for processing their data?

You need to include information about your lawful basis (or bases, if more than one applies) in your privacy notice. Under the transparency provisions of the GDPR, the information you need to give people includes:

• your intended purposes for processing the personal data; and
• the lawful basis for the processing.

This applies whether you collect the personal data directly from the individual or you collect their data from another source.