Consent is only one lawful basis. The correct challenge is to identify the purpose, the basis chosen before processing began and whether its conditions are actually met.
Key points
- The post-DUAA UK GDPR has seven Article 6 lawful bases.
- An organisation cannot always switch basis retrospectively to rescue unlawful processing.
- Special category data needs an additional Article 9 condition.
- Withdrawing consent stops consent-based processing, but not processing supported by a different valid basis.
- Legitimate interests requires purpose, necessity and balancing; recognised legitimate interest is a distinct, narrower basis.
The seven bases
The bases are consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. “We need it” or “it is in our terms” is not itself a basis. Contract requires objective necessity for the contract, not mere usefulness. Legal obligation requires a relevant legal duty. Public task must rest on law. Ordinary legitimate interests requires a three-part assessment.
Consent and withdrawal
Valid consent must be freely given, specific, informed, unambiguous and capable of withdrawal as easily as it was given. Power imbalance can make consent inappropriate, particularly at work. Withdrawal is forward-looking and does not automatically make earlier lawful processing unlawful.
Legitimate interests after the DUAA
Ordinary legitimate interests still requires a purpose test, necessity test and balancing test. The DUAA added examples and a separate recognised-legitimate-interest basis for specified conditions. That separate basis still requires necessity, but not the ordinary balancing test. It is not a general shortcut and it does not remove transparency, fairness, security or rights duties.
Purpose by purpose
An organisation may need different bases for different purposes. A bank might use contract to operate an account, legal obligation for anti-money-laundering checks and legitimate interests for some fraud prevention. Ask for a purpose-by-purpose explanation and challenge the one that affects you.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| An app says consent is mandatory for analytics | Ask whether the optional tracking is genuinely necessary and whether refusal is possible. | Cookies, tracking and complaints |
| An employer relies on consent for routine monitoring | Examine imbalance and whether another basis was actually chosen. | Employment data and surveillance |
| A company says “legitimate interest” without analysis | Ask for the interest, necessity and balancing rationale. | Right to object |
Useful wording
“For each purpose, please identify the Article 6 lawful basis selected, explain why the processing is necessary, and identify any Article 9 condition. If you rely on legitimate interests, please explain the interest, necessity and balancing assessment.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.