Consent as the Default Lawful Basis
Consent often feels like the safest lawful basis under the UK GDPR but it is not the gold standard. Not only can it be hard to satisfy the high threshold for it to be valid, but it is also preferable not to rely on it when actually something else fits better. I look at why this misunderstanding exists and what organisations should do in practice to avoid giving people the wrong impression.
@dynamicwang on Unsplash
Consent as the Holy Grail
I am not against using consent as a lawful basis but getting it right under the UK GDPR is not dissimilar to getting a baking recipe right.
If the organisation can’t satisfy and evidence all elements of valid consent under Article 7, the “consent cake” will not bake properly.
Why Organisations Overuse Consent
Choice Left to the Individual
In my experience, there is a tendency for people outside the data protection industry to default to consent when considering how personal data is used.
Some of this is due to the GDPR making the headlines between 2016 and 2018, when “consent” was buzzword, however misplaced even then. Another explanation could be that decision-makers see consent as the ethical choice.
This is not a bad thing. It’s right, in principle, that people should get asked if they want their personal data used in a certain way.
Nevertheless, this “choice” becomes a facade when:
The Article 7 conditions (and additional ones if the data is special category) have not been met, so consent is invalid and people actually don’t make a real choice (eg, when consent is bundled for different activities and it’s not specific to each).
Consent is shoehorned onto an activity that is inappropriate for consent because people’s desire whether or not their data is used is irrelevant (eg, there is a law that requires data collection).
Shifting Responsibility to the Individual
The other side of the choice coin is that the person then becomes, logically, responsible for the choices they make.
A ticked box can make an organisation feel safe – if the data subject says yes, why not collect the data? This can avoid (not that it should) harder internal conversations and deeper analytical discussion about appropriateness.
Despite all that, there is no hierarchy of lawful bases. Only because asking for consent sounds polite, it doesn’t make it the best option from the six (now seven in the UK*) lawful bases.
The Hidden Cost of Consent as a Lawful Basis
There are some situations when using consent to begin with raises red flags which need to be addressed before using personal data.
Power imbalances, most often with employees, patients, citizens
Consent is a condition to obtaining something, for example accessing a service
Even when consent is the right basis to rely on, it must be done right to be valid (otherwise, there is no lawful basis at all). This includes:
Not switching lawful bases, from consent to something else;
Withdrawing has to be as easy as giving consent;
Recording and refreshing consent needs to be clear and auditable.
If an organisation is struggling to satisfy its various validity legs, that’s when it’s time to review the lawful basis list again.
How to Decide Between Consent and Other Lawful Bases
To make consent valid, the focus should not be just on how you ask the question itself, but the circumstances around it too. Before settling on consent, work through these questions.
Start with the alternative lawful bases
Is this processing necessary to perform a contract with the individual, or to take steps they've asked for before entering one?
Is there a legal obligation that requires this processing?
Is it necessary for a task in the public interest or an official function set out in law?
Could legitimate interests apply, and would the processing pass a balancing test?
If any of these apply, another basis is likely a better fit.
Test whether consent can genuinely be free
Is there a power imbalance, such as employer and employee?
Would the person suffer any detriment, or lose access to a service, if they said no?
Is consent bundled with terms and conditions or made a condition of the service?
A "yes" here is a red flag for consent.
Test whether you can live with consent
If someone withdraws consent, can you actually stop the processing?
Would you continue processing anyway on another basis?
Can you make withdrawing as easy as giving consent?
Can you record who consented, when, how, and what they were told?
If you can't answer "yes" to all of these, consent will be hard to sustain.
Test whether consent is specific and informed
Can you explain the purpose clearly enough for a genuine, informed choice?
Are separate purposes given separate consent options?
Any "no" here needs fixing before consent will be valid.
Check for special rules
Is this special category data, where explicit consent may be one of several possible Article 9 conditions?
Is it electronic marketing, cookies, or similar technologies, where PECR may require consent regardless of your UK GDPR lawful basis?
Does the processing involve children, who may need age-appropriate information or parental consent for online services?
If consent is the only basis left standing after these questions and you can genuinely honour a "no", it's probably the right choice.
If you're reaching for it because the others feel harder or you can’t satisfy the threshold in the UK GDPR, it probably isn't.
Bottom Line
This is by no means aimed to dissuade anyone from using consent as a lawful basis; but if you are, then the choice must be genuine and not a polite but a meaningless ask.
Asking for consent tells people they have a real say, and if they don't, you've given them the wrong impression from the start. This is unlawful as well as bad for brand loyalty and trust.
In other words, if the ingredients aren't there, don't bake the consent cake.
* Recognised legitimate interests under the Data (Use and Access) Act 2025