I believe it relates to the concept of "legitimate basis for processing" as found in the GDPR, only the Spanish version of the GDPR uses "base legítima" rather than "base legitimadora".

In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject
http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...

Para que el tratamiento sea lícito, los datos personales deben ser tratados con el consentimiento del interesado o sobre alguna otra base legítima establecida conforme a Derecho, ya sea en el presente Reglamento o en virtud de otro Derecho de la Unión o de los Estados miembros a que se refiera el presente Reglamento, incluida la necesidad de cumplir la obligación legal aplicable al responsable del tratamiento
https://eur-lex.europa.eu/legal-content/ES/TXT/?uri=CELEX:32...

The GDPR also uses the term "legitimate grounds":

the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...