Ask most business owners what GDPR requires and you'll hear the same answer: "You need people's consent." It's the most persistent misconception in data protection, and it leads to poor compliance decisions on both sides of the Irish Sea.
Why the myth persists
Cookie banners and marketing opt-ins are the most visible face of data protection. Every website visitor sees them, so consent has become shorthand for GDPR itself. Add in the intuitive idea that "it's my data, so you need my permission" and the myth is easy to understand.
What the law actually says
Article 6 of the GDPR (and UK GDPR) sets out six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task and legitimate interests. They carry equal weight. There is no hierarchy.
In practice, most business processing doesn't use consent:
Contract: processing a customer's details to deliver what they ordered
Legal obligation: retaining payroll and tax records
Legitimate interests: fraud prevention, network security, and much B2B marketing, subject to a balancing test
Why consent is often the wrong choice
Consent is the most fragile basis. To be valid it must be freely given, specific, informed and unambiguous. It can be withdrawn at any time, and withdrawal must be as easy as giving it. If someone withdraws, you can't simply move to a different basis, because the basis should be chosen at the outset and communicated in your privacy notice.
Employers should be especially wary. Because of the imbalance of power, employee consent is rarely considered freely given, so it's a poor foundation for HR processing.
The myth cuts both ways
Choosing the wrong basis in either direction creates risk. The Irish Data Protection Commission's 2023 decisions against Meta, which followed the EDPB's binding decision, found that contract was not a valid basis for personalised advertising. Choosing a basis because it's convenient, rather than because it fits, is the real problem.
Where consent genuinely applies
Consent is required in specific situations, usually driven by separate rules rather than the GDPR itself:
Non-essential cookies and similar technologies: under the ePrivacy Regulations 2011 in Ireland and PECR in the UK
Certain electronic direct marketing
Some special category data and international transfer derogations, depending on the context
That is why a cookie banner doesn't make a business GDPR compliant. It addresses one narrow area and says nothing about lawful basis, retention, security, processor contracts or data subject rights.
The Irish and UK divergence
Ireland remains under EU GDPR, supervised by the DPC. However, the UK now has its own evolving framework, to complicate matters for businesses working in both countries. The Data (Use and Access) Act 2025 introduces "recognised legitimate interests", a list of purposes where the balancing test isn't required and relaxes cookie consent requirements for some low-risk uses such as basic analytics. It also aligns PECR penalties with the UK GDPR's higher fines.
So this means that for businesses operating in both jurisdictions, a single compliance approach is no longer safe. Lawful basis analysis, cookie practices and marketing rules need to be checked against each regime.
A practical test
For each processing activity, ask: "What is our lawful basis, and why is it the right one?" If the answer is automatically "consent", the analysis probably hasn't been done.
Need help mapping your lawful bases or reviewing your cookie and marketing practices? Get in touch with Privacy Path.