There's actually 6 lawful bases for processing data https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulatio

There's actually 6 lawful bases for processing data https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/#what https://ico.org.uk/for-organisations/guide-to-data-protectio... though deciding which is applicable in a given situation is not straightforward. The legal basis is actually quite broad. For example, most companies need to keep records for accounting purposes for several years which would count as a lawful basis. Another example would be keeping client data in case you need to protect yourself against potential future litigation e.g. a gym may need to protect themselves against personal injury claims (otherwise you could injure yourself, ask them to delete the records and then sue them).