What are the Lawful Bases for Processing Personal Data in an Organization: How to choose one?