Lawful Bases and Consent Management
Every processing operation needs a lawful basis. The common set includes consent, contract necessity, legal obligation, vital interests, public task, and legitimate interests. The candidate's job is to match the basis to the purpose, not to the organisation. Consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative act; pre-ticked boxes, silence and bundled terms fail. Consent must be as easy to withdraw as to give, and withdrawal is prospective only - it does not retroactively invalidate prior processing.
Legitimate interests requires a three-part test: a genuine legitimate interest, necessity of the processing, and a balancing exercise against the individual's rights and expectations. Document the balancing test; examiners reward evidence. Contract necessity is narrow - it covers what is objectively needed to deliver the contract, not marketing add-ons. Legal obligation must reference an actual legal duty, not internal policy.
Traps
- Assuming consent is always best. Where a public authority or employer holds power imbalance, consent may be invalid; another basis is preferable.
- Confusing withdrawal with erasure - they are different rights.
- Treating a privacy notice as consent.
- Forgetting that changing purpose may require a fresh basis.
Rule of thumb
Ask: Can the individual realistically say no without detriment? If no, consent is likely invalid - pick another basis and document it.
Worked example: A gym adds a mandatory health questionnaire to membership sign-up. Bundled consent fails (not freely given, not specific). The gym should rely on a separate explicit consent for health data, with a genuine opt-out that doesn't block membership.