Principle of legality:

Personal data Processing is a regulated activity that must be subject to what is established by the law and in the remaining provisions therein that account for them;