Lawful Processing, Consent and Privacy Notices

Introduction and context

Data protection law does not generally prohibit the use of personal data. Instead, it establishes conditions under which personal data may be collected, used, disclosed, retained and deleted. The central question is therefore not simply whether an organisation wants to process information, but whether it can demonstrate a lawful, fair, transparent and proportionate basis for doing so.

This chapter uses the terminology and structure found in modern data-protection frameworks, especially the European Union General Data Protection Regulation (GDPR). The same principles are reflected, with variations, in many national privacy laws. Students must always check the law applicable to the organisation, individuals and transaction concerned. Concepts such as “personal data,” “consent,” “child,” “sensitive data” and “privacy notice” may have jurisdiction-specific definitions.

Lawful processing is closely connected with accountability. An organisation should be able to explain why processing is necessary, what legal basis supports it, what information individuals received, how choices were recorded, and whether the processing remains proportionate over time. Consent is important, but it is only one possible legal basis and is frequently used incorrectly.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the main legal bases for processing personal data.
2. Distinguish consent from contractual necessity, legal obligation and legitimate interests.
3. Evaluate whether consent is valid, informed, specific, freely given and demonstrable.
4. Identify additional requirements for children’s data and special-category or sensitive information.
5. Draft a clear, accessible and appropriately structured privacy notice.
6. Design a reliable consent and processing-record system.
7. Recognise professional, ethical and governance risks associated with unlawful or opaque processing.

1. The lawful-processing framework

Most comprehensive data-protection statutes begin with a set of principles. A lawful basis does not make every use of data lawful. Processing must also satisfy requirements concerning fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

1.1 Personal data and processing

Personal data is information relating to an identified or identifiable living individual. A name, identification number, email address, location record, online identifier, photograph, employment record or device identifier may qualify. Information can be personal even when the organisation does not know the individual’s name, provided the person can reasonably be identified by reference to available information.

Processing is interpreted broadly. It includes collecting, recording, organising, storing, consulting, analysing, sharing, combining, altering, retrieving, restricting and deleting data. Consequently, an organisation needs a lawful basis not only when it first collects information but throughout the relevant processing lifecycle.

1.2 The principal legal bases

Under the GDPR model, ordinary personal data may be processed when at least one of the following bases applies:

These bases are alternatives, not cumulative requirements. An organisation normally identifies the most appropriate basis before processing begins. It should not collect consent merely as a precaution when the real basis is a legal obligation or contract. Doing so can create confusion and may undermine the organisation’s ability to rely on consent later.

1.3 Necessity and proportionality

The word “necessary” has a disciplined legal meaning. Processing is not necessary simply because it is convenient, customary or potentially profitable. The organisation should ask whether the stated purpose can reasonably be achieved with less data, fewer recipients, a shorter retention period or a less intrusive method.

Proportionality involves balancing the objective against the impact on individuals. Relevant factors include the sensitivity of the data, the individual’s reasonable expectations, the scale of the processing, the relationship between the parties, the presence of vulnerable individuals, and the availability of safeguards.

A lawful basis is therefore best understood as part of a decision process:

Figure: A practical process for selecting and reviewing a lawful basis.

2. Consent as a legal basis

Consent is an affirmative indication of a person’s wishes by which the person signifies agreement to processing of personal data. Valid consent has several cumulative qualities. If one essential quality is missing, the organisation may not be able to rely on consent.

2.1 Freely given

Consent must be voluntary. It is doubtful where an individual faces pressure, detriment or an unreasonable choice if they refuse. The imbalance between a public authority and resident, employer and worker, school and pupil, or dominant platform and user may make consent inappropriate or require particularly strong safeguards.

A service should not normally be made conditional on consent to processing that is unnecessary for the service. For example, an online retailer may need an address to deliver goods, but it generally cannot require consent to unrelated promotional profiling as the price of delivery. Separate optional features should be genuinely optional.

2.2 Specific

Consent should relate to a defined purpose. A statement such as “I agree to all uses of my information” is too vague to support multiple unrelated activities. Where processing purposes are distinct, consent should be granular. Marketing by email, marketing by telephone, sharing with advertising partners and publication in a public directory may require separate choices.

Specificity also requires that the organisation identify the relevant categories of data, recipients or recipient categories where important, and the nature of the intended processing. A broad consent may be acceptable in limited research contexts only where the applicable law permits it and appropriate safeguards and governance exist.

2.3 Informed

A person cannot make an informed choice without meaningful information. Before consent is obtained, the organisation should explain at least:

• who is collecting the data;
• the purposes of processing;
• the types of data involved;
• whether data will be shared or transferred;
• the consequences of refusing or withdrawing consent;
• how consent can be withdrawn; and
• where to obtain further information.

The explanation should use plain language, avoid hidden terms and be available before the decision. A privacy notice may provide the detail, while a short consent prompt provides the immediate choice. These documents should be consistent.

2.4 Unambiguous affirmative action

Consent requires an active indication. Examples include ticking an unchecked box, selecting a clearly labelled button or signing a consent form. Silence, inactivity, pre-ticked boxes and mere use of a website normally do not demonstrate affirmative consent.

The action should be linked clearly to the relevant purpose. A single “continue” button should not silently combine acceptance of terms, consent to optional marketing and agreement to unrelated data sharing.

2.5 Demonstrable and withdrawable

The organisation bears responsibility for demonstrating consent. It should preserve evidence of who consented, when, what information was presented, what wording was accepted, which purposes were selected, and whether consent was later withdrawn.

Withdrawal must be as easy as giving consent. If consent is obtained online in one step, the organisation should not require a complex written process or a telephone call to withdraw it. Withdrawal does not usually make earlier lawful processing unlawful, but it requires the organisation to stop the relevant future processing unless another lawful basis applies and the law permits a change of basis.

2.6 Consent is not a waiver of rights

Consent does not remove other data-protection rights. An individual may still have rights of access, rectification, erasure, restriction, objection or data portability where applicable. Nor does consent excuse excessive collection, insecure storage or indefinite retention.

3. Children’s data

Children may be less able to understand privacy risks, targeted advertising, behavioural profiling and long-term consequences. Their data therefore deserves enhanced protection. The exact age threshold and rules differ between jurisdictions.

Where an online service relies on consent and is offered directly to a child, the applicable law may impose a minimum age for valid consent. Below that age, consent may need to be authorised or given by a person holding parental responsibility, and the organisation may need to make reasonable efforts to verify that authorisation. Verification should be proportionate: collecting excessive identity documents can itself create unnecessary risk.

The child’s best interests should influence the design of collection, notices and defaults. Good practice includes:

• using age-appropriate language and examples;
• avoiding manipulative interfaces and repeated pressure;
• disabling unnecessary public visibility by default;
• limiting profiling and targeted advertising;
• collecting only information needed for the stated service;
• providing accessible methods for parental and child rights requests; and
• establishing deletion and retention controls.

Parental involvement does not automatically make every use lawful. The purpose must still be necessary, fair and proportionate. A parent’s permission is also not a blanket licence to disclose a child’s information to unrelated parties.

4. Sensitive and special-category information

Some information creates heightened risks of discrimination, stigma, identity theft or physical harm. Under GDPR terminology, special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used uniquely to identify a person, health data, and information about sex life or sexual orientation.

The processing of such data generally requires both:

1. a lawful basis for ordinary personal data; and
2. an additional condition permitting special-category processing.

Consent, where used, may need to be explicit rather than merely implied. Other conditions may include employment and social-protection law, protection of vital interests, establishment or defence of legal claims, substantial public interest, healthcare, public health and archiving or research, subject to statutory safeguards.

Criminal-conviction and offence data are often subject to a separate statutory regime. An organisation should not assume that a general consent form authorises the collection of criminal records, health information or biometric identifiers.

Data may be sensitive in context even if it is not in a statutory special category. Financial records, precise location, children’s information, domestic-abuse records and authentication data may require strong controls because misuse could cause substantial harm.

5. Privacy notices

A privacy notice explains how an organisation processes personal data. It is a transparency instrument, not merely a legal disclaimer. An effective notice enables a reasonable person to understand the processing and make meaningful choices.

5.1 Core contents

A notice should generally identify:

• the organisation responsible for processing and contact details;
• the data-protection officer or privacy contact, where applicable;
• the categories of personal data collected;
• the purposes of each processing activity;
• the legal basis for each purpose;
• the legitimate interests relied upon, where relevant;
• recipients or categories of recipients;
• international transfers and safeguards, where relevant;
• retention periods or the criteria used to set them;
• individual rights and how to exercise them;
• the right to complain to the relevant supervisory authority;
• whether data is required by law or contract and the consequences of not providing it;
• the existence of automated decision-making or profiling and meaningful information about its logic and consequences; and
• the source of the data when it was not collected directly from the individual.

The notice should not state that every field is “mandatory” unless there is a genuine legal or operational need. It should distinguish required data from optional data.

5.2 Clarity, layering and timing

A notice should be concise enough to read but complete enough to be useful. Layering is an effective method: a short first layer identifies the organisation, purpose, data categories and immediate choice; links or headings then provide fuller details about retention, rights, transfers and governance.

The notice must be provided at the appropriate time. Direct collection normally requires information at or before collection. Indirect collection may require notice within a legally specified period or at the first communication, subject to exceptions. A notice placed permanently in a website footer may not be sufficient when a person is entering sensitive information in a mobile application.

Accessibility matters. Notices should consider language, literacy, disability, screen size and the user’s age. Technical or legal wording that conceals the practical effect may fail the fairness and transparency requirement even if every formal heading appears.

5.3 Privacy notices and consent prompts

A privacy notice and a consent request serve different functions. The notice explains the broader processing environment. The consent prompt obtains a particular voluntary choice. A consent prompt should not be buried in a long notice, and a notice should not pretend that all processing is consent-based.

A useful consent record might contain the following fields:

Records should be protected against unauthorised alteration. Audit logs, access controls, versioning and retention schedules are governance safeguards; they do not justify retaining consent records forever.

6. Legitimate interests and the balancing assessment

Legitimate interests can be useful where an organisation has a genuine interest, processing is necessary, and the individual’s rights do not override that interest. It is not a universal alternative to consent. Public authorities performing official tasks may face restrictions on relying on legitimate interests for those tasks.

A practical legitimate-interest assessment has three stages:

1. Purpose test: What precise legitimate interest is pursued? It may be fraud prevention, physical security, network protection or a proportionate business communication.
2. Necessity test: Is the processing genuinely necessary for that interest, or could the objective reasonably be achieved with less intrusive data or methods?
3. Balancing test: Would individuals reasonably expect the processing? What is the nature and sensitivity of the data, the likely impact, the relationship between the parties, and the safeguards? Do the individual’s interests, rights or freedoms override the organisation’s interest?

The assessment should be documented and reviewed when the purpose, technology, risk or legal environment changes. Individuals should normally be informed of the legitimate interest and may have a right to object, particularly to direct marketing.

7. Worked application: choosing between contract and consent

A language-learning platform collects a user’s name, email address, payment details and progress records. It needs the email address to create an account, send security messages and provide access to purchased lessons. It also wants to send optional promotional messages about unrelated courses.

The platform should not ask the user to consent to account administration if that processing is necessary to perform the subscription contract. The contract basis may support account creation, payment administration and delivery of purchased lessons. The platform should explain these activities in its privacy notice.

Promotional messages are a separate purpose. Depending on the applicable electronic-marketing law, the platform may need consent or may be able to rely on a narrow existing-customer exception. If consent is required, the marketing box should be unchecked, optional and separate. The platform must record the wording and provide a simple unsubscribe mechanism.

Progress records may be necessary to provide personalised lessons, but broad behavioural profiling for advertising may require a separate assessment and possibly consent. The organisation should not treat all uses of “learning data” as one indivisible purpose.

8. Case study: BrightSteps educational application

This is an illustrative fictional case.

Background

BrightSteps operates a mobile application for children learning mathematics. The application collects a child’s username, age band, answers, device identifier and approximate location. It proposes to share “insights” with advertising partners and asks the child to press “I agree” during registration. The privacy policy is written for adults and contains a pre-selected marketing option.

Problem

BrightSteps believes that the registration click is consent for all processing. It has no reliable record of the privacy notice version displayed, does not verify parental authorisation where required, and retains raw answers and device identifiers indefinitely. Teachers and parents are unclear about how to request deletion.

Analysis

The application must first identify distinct purposes: account creation, educational feedback, security, analytics, advertising and disclosure to schools or parents. Account administration and educational feedback may be necessary for the requested service, but advertising is not automatically necessary. The organisation must determine the relevant child-consent threshold under its applicable law and design an age-appropriate process.

The pre-selected marketing option is not an affirmative choice. The adult-oriented notice is unlikely to provide clear, child-appropriate information. Sharing with advertising partners may create profiling risks that are disproportionate to the educational purpose. Indefinite retention conflicts with storage limitation unless a documented, lawful justification exists.

Approach and solution

BrightSteps should:

1. map each processing purpose and data category;
2. select and document a lawful basis for each purpose;
3. remove advertising by default and assess whether it is necessary at all;
4. use a child-friendly layered notice and a separate parent-facing explanation;
5. implement age assurance and proportionate parental authorisation where legally required;
6. provide separate, optional choices for genuinely optional processing;
7. maintain versioned consent records and withdrawal mechanisms;
8. establish retention periods for answers, identifiers and account records;
9. restrict access and encrypt data in transit and at rest where appropriate; and
10. create clear parent, child and school channels for rights requests.

Outcome

The redesigned service can distinguish necessary educational processing from optional analytics and marketing. Parents and children receive understandable information, the organisation can demonstrate its decisions, and unnecessary sharing is reduced. The changes also improve trust and reduce the risk that a child’s educational history becomes a permanent commercial profile.

Learning points

The case illustrates that lawful processing is a system of connected decisions. Consent cannot repair an unsuitable purpose, excessive collection, poor security or a misleading notice. Children’s data requires not only a technically valid permission mechanism but also age-appropriate design and heightened proportionality.

9. Governance, technology and artificial intelligence

Digital systems can make privacy choices easier or harder. Consent-management platforms can record timestamps, wording, purpose and withdrawal, but automated records are not proof of validity if the interface used dark patterns. A system should preserve evidence without collecting more identity information than necessary.

Artificial-intelligence systems create additional concerns. Training, evaluation, inference and deployment may each be separate processing purposes. A model’s use of personal data does not become lawful merely because the data was previously collected. Organisations should assess the source, accuracy, purpose compatibility, retention, access, profiling effects and rights mechanisms. Where automated decisions significantly affect individuals, applicable law may require human involvement, information and challenge procedures.

Privacy notices should describe AI or profiling in meaningful terms. Merely stating “we use algorithms” does not explain the relevant data, purpose, likely effects or available safeguards. Organisations should also consider data-protection impact assessments for high-risk processing, especially involving children, large-scale monitoring, biometric data or systematic profiling.

10. Common failures and professional best practice

Common failures include selecting consent because it appears simple, combining unrelated purposes in one checkbox, using pre-ticked boxes, failing to record the notice version, treating withdrawal as an exceptional complaint, retaining data without a schedule, and copying a generic privacy policy that does not describe actual operations.

A sound professional process should:

• create a data inventory and purpose map;
• identify the controller and processors;
• document the lawful basis and any special-category condition;
• test necessity and proportionality;
• use plain, layered and accessible notices;
• separate required processing from optional choices;
• record consent in a tamper-resistant, auditable manner;
• make withdrawal and rights requests practical;
• apply child-sensitive and vulnerability-sensitive safeguards;
• establish retention, deletion and review schedules; and
• train staff and review processing when products, vendors or laws change.

The ethical standard is higher than avoiding a fine. Individuals should be able to understand and reasonably anticipate how information about them is used. Good privacy practice protects autonomy, dignity, equality, security and institutional trust.

Chapter Summary

Lawful processing requires more than identifying a legal basis. Organisations must connect purpose, necessity, fairness, transparency, minimisation, security and retention throughout the data lifecycle. Consent is valid only when it is freely given, specific, informed, affirmative, demonstrable and withdrawable. It should not be used where processing is actually required by contract, law or a public task, and it cannot legitimise excessive or insecure processing.

Children’s data requires age-appropriate communication, proportionate age and parental-authorisation measures, careful defaults and enhanced protection against profiling. Sensitive or special-category data generally requires both an ordinary lawful basis and an additional statutory condition. Privacy notices should explain real processing in clear, accessible and layered language, while consent records should preserve the exact choice, wording, timing, scope and withdrawal history. Effective governance treats privacy as an ongoing accountability process rather than a one-time form.

Key Terms

Personal data: Information relating to an identified or identifiable living individual.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure and deletion.

Lawful basis: A legally recognised justification for processing personal data.

Consent: A voluntary, specific, informed and affirmative agreement to specified processing.

Freely given: Consent provided without pressure, coercion or unfair detriment for refusal.

Specificity: The requirement that consent relate to clearly defined purposes.

Affirmative action: A clear active step indicating agreement.

Withdrawal: The act of ending consent for future processing.

Contractual necessity: Processing required to perform a contract or requested pre-contractual steps.

Legal obligation: Processing required to comply with a binding legal duty.

Legitimate interests: A lawful organisational or third-party interest pursued through necessary and balanced processing.

Special-category data: Particularly sensitive information subject to additional legal conditions.

Child’s data: Personal data relating to a child, subject to enhanced safeguards under applicable law.

Privacy notice: Information explaining an organisation’s processing practices and individual rights.

Layered notice: A notice presenting key information first and fuller details through additional sections or links.

Purpose limitation: Using data only for specified, explicit and legitimate purposes.

Data minimisation: Limiting data to what is adequate, relevant and necessary.

Retention period: The period for which personal data is kept or the criteria used to determine it.

Accountability: The responsibility to comply with data-protection requirements and demonstrate compliance.

Dark pattern: An interface design that manipulates or obstructs an individual’s privacy choice.

Review Questions

Short Answer Questions

1. What is meant by a lawful basis for processing personal data?
2. Identify four qualities required for valid consent.
3. Why is a pre-ticked marketing box generally problematic?
4. What is special-category data?
5. State four matters that should appear in a privacy notice.

Long Answer Questions

1. Explain the main legal bases for processing personal data and give one example of each.
2. Discuss why consent should not be used as a default basis for all organisational processing.
3. Explain the additional safeguards that may be required when processing children’s data.
4. Describe the relationship between a privacy notice and a consent request.
5. Explain how an organisation can maintain reliable consent records throughout the data lifecycle.

Analytical / Application Questions

1. A retailer requires customers to agree to personalised advertising before allowing them to purchase goods. Analyse whether this is likely to constitute freely given consent and recommend a lawful design.
2. A hospital wants to use patient health records for an unrelated commercial research project. Identify the legal and governance questions that must be addressed before processing begins.
3. Design a lawful-processing plan for a children’s educational application that collects usernames, learning progress, device identifiers and optional location data. Justify the legal bases, notice structure, consent controls and retention approach.

Multiple Choice Questions with Answers

Question 1

Which legal basis is most directly associated with processing required to deliver goods ordered by an individual?

A. Consent

B. Contractual necessity

C. Vital interests

D. Public task

Correct Answer: B. Contractual necessity

Question 2

Which action is the clearest example of affirmative consent?

A. Leaving a box pre-ticked

B. Continuing to browse a website

C. Selecting an unchecked box labelled for optional marketing

D. Failing to object to an email

Correct Answer: C. Selecting an unchecked box labelled for optional marketing

Question 3

What is a central requirement of freely given consent?

A. The individual must receive a financial reward

B. The service must always be free

C. Refusal must not normally cause unfair detriment for optional processing

D. The organisation must obtain consent annually

Correct Answer: C. Refusal must not normally cause unfair detriment for optional processing

Question 4

Which statement about special-category data is correct?

A. It can always be processed with ordinary consent

B. It generally requires both an ordinary lawful basis and an additional condition

C. It is limited to names and addresses

D. It is never permitted to be processed

Correct Answer: B. It generally requires both an ordinary lawful basis and an additional condition

Question 5

What is the primary purpose of a privacy notice?

A. To replace all security controls

B. To explain processing practices and individual rights

C. To guarantee that consent is valid

D. To extend retention periods

Correct Answer: B. To explain processing practices and individual rights

Question 6

Which item is especially important in a consent record?

A. The organisation’s preferred advertising slogan

B. The exact wording and notice version presented

C. The employee’s personal opinion about the user

D. An unlimited retention period

Correct Answer: B. The exact wording and notice version presented

Question 7

A platform wants to use account data for unrelated promotional profiling. What should it do first?

A. Assume the account-registration basis covers every future purpose

B. Identify and assess the separate promotional purpose

C. Delete the account immediately

D. Treat profiling as a legal obligation

Correct Answer: B. Identify and assess the separate promotional purpose

Question 8

Why do children’s services commonly require age-appropriate notices?

A. Children cannot ever be data subjects

B. Children may have reduced ability to understand privacy risks and consequences

C. Age-appropriate notices remove all legal duties

D. They permit indefinite retention

Correct Answer: B. Children may have reduced ability to understand privacy risks and consequences

Question 9

Which statement best describes legitimate interests?

A. They permit any processing that produces profit

B. They require a purpose, necessity assessment and balancing of impacts

C. They are identical to consent

D. They apply only to children’s data

Correct Answer: B. They require a purpose, necessity assessment and balancing of impacts

Question 10

Withdrawal of consent should generally be:

A. More difficult than giving consent

B. Available only by court order

C. As easy as giving consent

D. Unavailable after data is collected

Correct Answer: C. As easy as giving consent