In data protection terms, ‘lawfully’ must satisfy one of the appropriate lawful basis for processing and must not contravene any other statutory or common law obligations.