Getting permission right
Notice, consent, legitimate uses and Consent Managers
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Two ways to process personal data lawfully
You may process personal data only for a lawful purpose, and only on one of two grounds: consent, or a listed legitimate use. No ground means no processing.
A 'lawful purpose' is any purpose not expressly forbidden by law (s.4(2)). Unlike the GDPR there is no general 'legitimate interests' ground and no 'contract' ground. If your use is not on the s.7 list, you need consent.
Every consent request needs a notice
Before or at the moment you ask for consent, you must give a notice. Rule 3 says what it must contain and how it must look.
Legacy data matters too. If you already process data based on consent given before the Act starts, s.5(2) requires you to send these people a notice as soon as reasonably practicable. You may keep processing until they withdraw. Plan this re-notice campaign early.
Valid consent has six qualities
Pre-ticked boxes, silence, or one 'agree to everything' button do not meet this standard.
Consent must also be limited to the data necessary for the specified purpose. And if a dispute arises, the burden is on you: s.6(10) says the Data Fiduciary must prove that notice was given and consent was obtained. Keep consent logs with timestamps, notice versions and purposes.
Example: a food delivery app
Consent covers only what is necessary for the purpose. Any part of the consent that goes beyond that is invalid.
The Act's own illustration is a telemedicine app that asks for consent to its service and also for access to the user's mobile contacts. The consent is invalid for the contacts part. Unbundle optional purposes, such as marketing, into separate, optional consents.
When someone withdraws consent
Processing done before withdrawal stays lawful. After withdrawal, you and your processors must stop and erase, unless a law requires the data to be kept.
The person bears the consequences of withdrawing (s.6(5)). For example, if they withdraw consent needed to deliver a service, you may stop providing that service. Build withdrawal into your systems so the signal reaches every vendor and database that holds the data.
Legitimate uses: no consent needed
Section 7 lists situations where consent is not needed. It is a closed list, so check carefully before you rely on it.
The 'voluntarily provided' use is narrow. The Act's example: a buyer gives a pharmacist their phone number to receive the payment receipt by SMS. The pharmacist may use it for the receipt, not for marketing. Employment covers purposes such as safeguarding the employer from loss or liability and providing benefits the employee asks for.
Consent Managers
Consent Managers are registered platforms that let people give, review and withdraw consent across many businesses in one place. Their rules start in November 2026.
Consent Managers owe a fiduciary duty to the Data Principal, not to the businesses. Rule 4 and the First Schedule set registration conditions and obligations, including independent certification of the platform, no sub-contracting of duties, and Board approval for changes in control. Using one is optional for a business, but you must accept consent and withdrawals that arrive through them.
In one line
Next: the duties you carry every day once you hold personal data.