For data processing to be lawful, personal data must be processed on the basis of the consent of the data subject concerned or on another legitimate basis provided for by law, either in this Regulation or in another act of Union or Member State law referred to in this Regulation, including the need to comply with legal obligations to which the controller is subject or the need to perform contracts to which the data subject is part of or in order to carry out pre-contractual steps requested by the data subject.