A lawful basis must be established before processing begins and should be documented. If no lawful basis applies then the processing will be unlawful and in breach of the GDPR principles.