Having established that you are processing personal data, and that the GDPR applies, you cannot just rush ahead and start processing it without what is called a lawful basis for doing so.