GDPR is not all about consent. Consent must be explicit, and it is revocable. So although it has its uses as a lawful basis for processing, it will not be the first option in many cases. Firms which sought consent for marketing emails were disappointed by the level of response, so many have relied on legitimate interests, though that requires the firm to undertake a ‘Legitimate Interests Assessment’. The ICO published guidance on Legitimate Interests in March 2018 and on Consent in May 2018.
‹ Back to Publications