All You Need to Know About Consent as a Lawful Basis for Processing Data
Consent is one of the most recognised — and most misunderstood — lawful bases under UK GDPR. Many organisations assume that consent is the easiest or safest option, but in reality, it is often the most complex. When used correctly, consent empowers individuals and strengthens trust. When used incorrectly, it exposes organisations to significant compliance risks, invalid processing, and potential ICO enforcement.
This article explains everything organisations need to know about consent as a lawful basis: what it is, when to use it, how to obtain it, and why relying on consent incorrectly can lead to serious consequences.
What Is Consent Under UK GDPR?
Consent is a freely given, specific, informed, and unambiguous indication of an individual’s wishes his / her personal data to be processed. It must involve a clear affirmative action — meaning the individual actively agrees to the processing of their personal data.
Valid consent must be:
- Freely given – no pressure, no imbalance of power
- Specific – tied to a clear, defined purpose
- Informed – individuals understand what they are agreeing to
- Unambiguous – no doubt about the intention
- Opt‑in – never pre‑ticked boxes or implied consent
- Documented – organisations must be able to prove it
If any of these elements are missing, consent is invalid.
When Should Organisations Use Consent?
Consent should be used only when individuals have genuine choice and control. It is appropriate when:
- individuals can easily say “no”
- the processing is optional
- the organisation does not rely on the data to deliver a core service
- the individual would not suffer detriment by refusing
- the organisation is not in a position of power (e.g., employer vs employee)
Common examples include:
- marketing communications
- optional cookies and tracking technologies
- participation in surveys or research
- optional profiling
- non‑essential data collection
Consent is not appropriate when the processing is necessary for a contract, legal obligation, or legitimate interest.
When Consent Should Not Be Used
Consent is not valid if:
- the individual cannot refuse without negative consequences
- the organisation needs the data to deliver a service
- the relationship involves a power imbalance (e.g., employer/employee)
- the processing is required by law
- the individual is not given a genuine choice
- consent is bundled with terms and conditions
- consent is assumed or implied
Using consent incorrectly is one of the most common GDPR mistakes.
How to Obtain Valid Consent
To be compliant, organisations must ensure that consent is:
Clear and Transparent
Individuals must understand:
- what data is collected
- why it is collected
- how it will be used
- who it will be shared with
- how long it will be kept
- how they can withdraw consent
Granular
Separate consents must be provided for separate purposes. For example:
- marketing emails
- marketing SMS
- profiling
- third‑party sharing
Opt‑In
Consent must be given through:
- ticking a box
- selecting a preference
- signing a statement
- choosing settings
- giving clear verbal agreement
Easy to Withdraw
Individuals must be able to withdraw consent:
- at any time
- without penalty
- as easily as they gave it
Organisations must act on withdrawals promptly.
Documented
You must keep records showing:
- who consented
- when they consented
- how they consented
- what they were told
- whether they have withdrawn consent
Without evidence, consent is not valid.
Special Category Data: Explicit Consent
When processing special category data, organisations may rely on explicit consent. This requires:
- a clear statement of consent
- a written or recorded affirmative action
- detailed information about the processing
- proof that the individual understood the implications
Explicit consent is stronger and more formal than standard consent.
Consent for Children
If the individual is under 13, consent must come from someone with parental responsibility. Organisations must take reasonable steps to verify this.
Privacy information must be:
- age‑appropriate
- clear
- accessible
- easy to understand
Children’s data always requires enhanced protection.
What Happens When Consent Is Invalid?
If consent is invalid, the processing is unlawful. This can lead to:
- ICO investigations
- enforcement notices
- mandatory deletion of data
- reputational damage
- financial penalties
The ICO has repeatedly stated that organisations must not rely on consent when another lawful basis is more appropriate.
Why Consent Is Often the Riskiest Lawful Basis
Consent seems simple — but it is the most fragile lawful basis. It can be withdrawn at any time, and if withdrawn, the organisation must stop processing immediately.
If the organisation cannot stop processing (because the data is essential), consent should never have been used.
This is why many organisations prefer:
- Contract
- Legal obligation
- Legitimate interests
These bases are more stable and less vulnerable to withdrawal.
Why Paying for Data Protection Support Is Always Cheaper Than ICO Fines
Incorrect use of consent is one of the most common reasons organisations face compliance issues. Professional data protection support ensures:
- correct lawful basis selection
- compliant consent mechanisms
- clear privacy information
- proper record‑keeping
- lawful cookie and marketing practices
- secure handling of withdrawals
- ongoing governance and monitoring
The cost of proactive compliance is minimal compared to the financial and reputational damage caused by an ICO investigation.
Conclusion
Consent is a powerful lawful basis — but only when used correctly. Organisations must ensure that consent is freely given, specific, informed, unambiguous, and easy to withdraw. They must also understand when consent is appropriate, when it is not, and how to document it properly.
By using consent responsibly and choosing the correct lawful basis for each processing activity, organisations can operate confidently, transparently, and fully in line with UK GDPR.
