Under Article 6 of the GDPR, your data collection and processing must be based on one of the following:

If one of the other five bases doesn’t strongly apply, we recommend you rely on user consent to gather and process data. Furthermore, if the data you collect is sensitive personal data, you must first obtain user consent to collect it.