Consent vs legitimate interests

Consent

Valid consent must be freely given, specific, informed, and unambiguous, given through a clear affirmative action such as ticking an unchecked box. Pre-ticked boxes, silence, or inactivity do not count. Consent must also be as easy to withdraw as it was to give.

Legitimate interests

This basis requires a three-part test: identify a legitimate interest, show the processing is necessary for it, and balance that interest against the individual's rights and freedoms. This is often documented in a Legitimate Interests Assessment (LIA). It's frequently used for things like fraud prevention or direct marketing to existing customers, but it cannot be used to override an individual's clear objection to marketing.

A common mistake is reaching for consent by default because it feels safest. In many business contexts, another basis, often contract or legitimate interests, is actually the more accurate and appropriate choice.