The rule that governs everything else
Most comprehensive data protection regimes share one non-negotiable idea: you may not process personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. unless you can point to a specific, pre-identified legal ground for doing so. Fix the ground before processing starts, write it down, and match it to a genuine purpose. Everything downstream, what you must tell people, which rights they can exercise, how long you can keep the data, flows from that choice.
The grounds themselves vary by regime, but the family resemblance is strong. Under the GDPR (Article 6), for example, the six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights.. Other laws (Brazil’s LGPD, for instance) list ten. The analytical task is the same everywhere: choose the ground that actually fits what you are doing, not the one that feels easiest to obtain.
Why consent is usually the worst default
Teams reach for consent because it feels safe and self-evidently fair. In practice it is the most fragile basis you can build on, for three reasons.
- It is withdrawable. A valid consent must be as easy to withdraw as to give. The moment someone withdraws, your ground evaporates and you must stop the processing that relied on it. If your operation cannot tolerate an arbitrary stop, consent was the wrong basis.
- It has a high bar. To be valid, consent must be freely given, specific, informed and unambiguous, given by a clear affirmative act. Pre-ticked boxes, bundled “accept all” flows, and consent extracted as a condition of a service that does not need it will all fail. Regulators routinely strike these down (the CNIL’s Criteo decision and the Luxembourg courts’ treatment of Amazon’s advertising both turned on defective consent/legitimate-interest reasoning: examples from the EU regime, not universal rules).
- It shifts control to the data subject in a way that is often inappropriate for processing you are in fact obliged or entitled to do anyway.
Consent earns its place where the individual genuinely has a free choice and you can honour a “no”: marketing to a warm list, optional cookies, sensitive-data processing with no better ground. It is a poor fit for core service delivery, fraud prevention, security, or record-keeping.
When legitimate interests beats consent
For routine business processing, a legitimate-interests-style basis (where the regime offers one) is frequently more honest and more robust. It does not collapse when someone changes their mind, and it forces you to do the analysis that consent lets you skip: a documented three-part test: identify the interest, show the processing is necessary for it, and balance it against the individual’s rights and reasonable expectations. The balancing test is the point. If you cannot articulate why your interest is not overridden, you do not have a lawful basis; you have a hope.
The trade-off: legitimate interests carries an absolute right to object in many regimes, and it cannot be used to launder processing that people would find unexpected or intrusive. Behavioural advertising is the classic failure case.
What changing basis mid-processing does to you
You do not get to start on consent, find it inconvenient, and silently switch to legitimate interests when withdrawals mount. Fairness and transparency require that people know the basis at the point of collection, and swapping it afterwards generally undermines both. The defensible positions are narrow:
| Situation | Position |
|---|---|
| New purpose, compatible with the original | May need a fresh basis for the new purpose; document compatibility |
| Same purpose, want a sturdier basis | Generally not permitted to swap retrospectively; re-paper going forward at best |
| Consent withdrawn | Stop; you cannot fall back to another basis for the same processing |
Treat the basis as a decision you must live with, not a label you can relabel.
The minimum that is genuinely useful
Record, per processing activity: the purpose, the basis, and, for legitimate interests, the balancing assessment; for consent, the record of what was consented to, when and how. That record is not bureaucracy. It is the first thing a regulator asks for, and the difference between “we thought about it” and “we guessed”.