For asset recovery by the legal owner, the usual lawful basis is legitimate interests under Article 6(1)(f). The lender, as controller, documents this in a Legitimate Interest Assessment (LIA), including the balancing test. Access is designed to be proportionate. For example, triggered by default rather than continuous blanket tracking, which strengthens that assessment. Where processing involves systematic location monitoring, a Data Protection Impact Assessment is also expected, and we help structure it.