Under Article 6 of the GDPR, your data collection and processing must be based on one of the following:
User Consent (GDPR consent examples)
Vital Interest of the User
If one of the other five bases doesn’t strongly apply, we recommend you rely on user consent to gather and process data. Furthermore, if the data you collect is sensitive personal data, you must first obtain user consent to collect it.