Article 3 5.

Where the information referred to in paragraph 1 contains personal data, entities shall ensure that any processing of those data is based on one of the lawful grounds for processing listed in Article 6(1) of Regulation (EU) 2016/679. This Regulation does not create a legal basis for the processing of personal data.