I want to look up the 6 lawful bases for processing personal data

If you process personal data [1] you must have a lawful basis to do so. There are only 6 lawful bases and they are set out below.

  1. Public task: the processing is necessary for you to perform a task in the public interest or for official functions which the University has.
  2. Vital interests: the processing is necessary to protect someone’s life.
  3. Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
  4. Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
  5. Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
  6. Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

[1] Personal data is information that relates to an identified or identifiable individual.