There's actually 6 lawful bases for processing data https://ico.org.uk/for-organisations/guide-to-data-protectio... though deciding which is applicable in a given situation is not straightforward.

The legal basis is actually quite broad. For example, most companies need to keep records for accounting purposes for several years which would count as a lawful basis. Another example would be keeping client data in case you need to protect yourself against potential future litigation e.g. a gym may need to protect themselves against personal injury claims (otherwise you could injure yourself, ask them to delete the records and then sue them).