You can only process personal data when you have la legal ground (art. 6 GDPR). The GDPR lists six possible lawful bases (legal grounds) for processing. Not all of them are used when doing research. The two most commonly used legal grounds for doing research are consent and public interest. There are situations, e.g. if you scrape Twitter, where asking for consent is simply impossible and public interest is not applicable. In that case contact your security/privacy officer and ask for advice.