The company processed the employee data without a sufficient legal basis on hand.
the company processed the employee data without a sufficient legal basis on hand
 company process  employee data without  sufficient legal basis  hand