Consent

Consent is one of the lawful bases for processing personal data under the GDPR. To be valid it must be freely given, specific, informed, and expressed through a clear affirmative action, and it must be as easy to withdraw as to give.

Because the bar is high and consent can be withdrawn at any time, organizations often rely on other lawful bases, such as contract or legitimate interest, where those fit better.