I want to look up the 6 lawful bases for processing personal data
If you process personal data  you must have a lawful basis to do so. There are only 6 lawful bases and they are set out below.
- Public task: the processing is necessary for you to perform a task in the public interest or for official functions which the University has.
- Vital interests: the processing is necessary to protect someone’s life.
- Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
- Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
 Personal data is information that relates to an identified or identifiable individual.