A lawful basis is the legal justification a pilot must have before recording personal data — not paperwork produced after the fact. GDPR Article 6 lists the possible bases, and for drone work two of them are workable in practice: the person's consent, or the operator's legitimate interest.
Legitimate interest is not a universal excuse. It requires a genuine purpose, a proportionate impact on people's privacy, and a documented Legitimate Interest Assessment (LIA) in which that weighing is written down. Without the assessment, the basis cannot be relied on.