GDPR Q36
Do I need to obtain consent for every data processing activity?
Q36. Do I need to obtain consent for every data processing activity?
Category: Consent
Consent is only one of six lawful bases. Use it when appropriate, but do not overuse it when another basis fits better.
In simple terms
- Assess each processing activity individually.
- Choose the lawful basis that best reflects your purpose.
- Document decisions and communicate them in privacy notices.
When consent is required
Consent is essential for non-essential cookies, direct marketing to individuals, and some high-risk processing where you need explicit agreement.
- Consent must be freely given, specific, informed, and unambiguous.
- Provide simple withdrawal mechanisms.
- Keep records of consent, including when and how it was obtained.
Other lawful bases
Contract, legal obligation, vital interests, public task, and legitimate interests may suit different activities.
- Explain your chosen basis in privacy notices.
- Once a basis is chosen, you cannot swap to another unless the new basis was compatible from the start.
- Avoid mixing multiple bases for the same processing without justification.
Practical steps to take
- List your processing activities and assess the appropriate lawful basis for each.
- Seek legal advice if unsure—especially for complex or high-risk processing.
- Record the basis in your processing register and privacy notices.
- Review decisions when processing changes or new laws emerge.
- Train staff so they understand when consent is necessary and when it is not.
Real-life examples
Service emails
A utility provider relies on contract to send essential billing information, not consent.
Charity fundraising
A charity uses consent for email fundraising but legitimate interests for postal mail, documenting the reasoning.
Helpful reminders
- Do not bundle consent with terms and conditions.
- If consent is withdrawn, stop the processing unless another lawful basis applies.
- Ensure staff can identify and record changes in lawful basis decisions.
Key takeaway
Choose the most appropriate lawful basis for each activity—consent is important but not always the answer.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.