Saying "We Have Consent" Is Not Enough

In this episode of Compliance Technologies, we continue our series on GDPR fines by unpacking one of the most commonly misunderstood topics in data protection: lawful basis and consent.

GDPR requires that every instance of personal data processing have a clear and appropriate lawful basis. While consent is often treated as a default justification, it is also one of the most fragile, especially when systems cannot properly handle withdrawal, purpose changes, or downstream data use.

We explore why "we have consent" is often not enough, how organizations misuse consent when other lawful bases may be more appropriate, and why lawful basis should be treated as a system-level design constraint, not just a legal checkbox.

This episode reframes lawful basis as something systems must actively enforce, track, and respect over time.

If you build, operate, or oversee systems that process personal data, this conversation will help you understand where compliance claims often break down, even when intentions are good.