Lawful basis is the reason processing is permitted
Under UK data protection law you need a reason to use personal data at all, chosen from a defined list, and you have to decide which one before you start.
There are six. Consent is one of them. The others include performing a contract, complying with a legal obligation and legitimate interests. Picking the right one matters because each carries different obligations and different rights for the person, and you cannot quietly switch later because the first choice became inconvenient.
More on UK GDPR
- Consent is one lawful basis, not the default answerOne setting out of six
- Access rights concern personal data, not every documentThe lines about you, not the page
- Erasure is not an absolute delete buttonIt will not travel the whole way
- Data portability is narrower than a database exportOnly what fits the frame
- Rectification requires organisations to be able to correct inaccurate personal data wherever it is maintainedCorrect it once, then chase every copy
- Restriction can pause use without erasing dataStopped, not shredded