In data protection terms, it must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations.