Businesses can establish a lawful basis by obtaining user consent, demonstrating contractual necessity, legitimate interests, or compliance with legal obligations.