What are the legal bases for processing data under the General Data Protection Regulations (GDPR)

For PTAs the legal bases for processing data is generally:

1. Consent - your customers have consented to you storing and using their data in the ways defined in your privacy policy and terms
2. Contract - they have explicitly agreed to your sites terms and conditions
3. Vital interests - if you capture medical / allergy information about a child for an event
4. Legitimate interests - it is in the legitimate interests of your organisation to contact your customers in certain ways