Consent is not automatically the safest lawful basis for using personal data.
The right basis depends on why the data is being used, whether the individual has a genuine choice, and how intrusive the processing is.
Consent works where someone can genuinely say no and your business is prepared to stop the processing if they do. Legitimate interests may be more appropriate where the processing serves a real and proportionate business purpose that people would reasonably expect.
Key Takeaways
Consent requires genuine choice and can be withdrawn.
Legitimate interests requires a clear purpose, necessity and balancing assessment.
Neither basis is automatically stronger than the other.
Marketing and cookies may also require a separate PECR analysis.
Special category data requires an additional Article 9 condition.
When Consent Is Appropriate
Consent should be freely given, specific, informed and unambiguous.
A useful test is:
If the person withdraws consent, would we genuinely stop the processing?
If not, consent may be the wrong basis.
This is particularly important in employment or other relationships where the individual may not have a genuinely free choice.
When Legitimate Interests Is Appropriate
Legitimate interests may be suitable where:
there is a clear business or third-party purpose;
the processing is necessary;
people would reasonably expect it; and
the impact on their privacy is proportionate.
Businesses should normally document this through a Legitimate Interests Assessment (LIA) covering:
the purpose;
necessity; and
whether the individual’s rights outweigh the business interest.
A commercial benefit alone is not enough.
Marketing and Cookies Need Extra Care
Legitimate interests under the UK GDPR does not automatically mean marketing is permitted.
The Privacy and Electronic Communications Regulations 2003 (PECR) may separately require consent for certain electronic marketing or cookies.
Business-to-business marketing can be treated differently from marketing to individuals, sole traders and some partnerships.
Where PECR requires consent, legitimate interests cannot be used to avoid that requirement.
Special Category Data
If the processing involves information such as health data, racial or ethnic origin, religious beliefs or biometric data used for identification, an Article 6 lawful basis is not enough.
A separate Article 9 condition is also required.
Before You Proceed, Check…
What is the exact purpose?
Does the individual genuinely have a choice?
Would you stop if consent was withdrawn?
Have you completed an LIA if relying on legitimate interests?
Does PECR apply?
Is special category data involved?
Does your privacy notice accurately explain the basis?
Common Mistakes Businesses Make
Using consent as the default
Consent is not automatically the safest option.
Relying on “business interests” without analysis
The purpose must still be necessary and proportionate.
Ignoring PECR
A UK GDPR lawful basis does not override separate marketing or cookie rules.
Switching basis later
Businesses should identify the correct lawful basis before processing begins.
FAQs
Is legitimate interests weaker than consent?
No. The correct basis depends on the purpose and circumstances.
Can legitimate interests be used for marketing?
Sometimes, but PECR must also be considered.
Do we need an LIA?
There is no mandatory statutory form, but businesses should be able to demonstrate why legitimate interests applies. A documented LIA is usually sensible.
Can employees give valid consent?
Sometimes, but caution is required because the employment relationship can make genuine choice difficult.
Has UK law changed recently?
Yes. Since February 2026, UK law also includes a separate recognised legitimate interests basis for certain specified public-interest purposes. This is different from ordinary commercial legitimate interests.
When to Get Support
Businesses should review their lawful basis when introducing new technology, changing how customer or employee data is used, or launching marketing activity.
Sterling Legal Solutions can support with privacy documentation, legitimate interests assessments and practical data-protection compliance.
Disclaimer
This article is provided for general information only and does not constitute legal, tax, financial, regulatory, investment or other professional advice. Specific advice should be obtained before relying on any particular course of action.
Sources
UK GDPR
Data Protection Act 2018
Data (Use and Access) Act 2025
Privacy and Electronic Communications Regulations 2003
Information Commissioner’s Office guidance on consent, legitimate interests and direct marketing