What is a lawful basis, and which one should I use?

The legal reason you are allowed to use someone data. Consent is only one of six, and often the weakest.

Every use of personal data needs a lawful basis. There are six: consent, performance of a contract, a legal obligation, vital interests, a public task, and legitimate interests.

Consent is the one people reach for first and it is frequently the wrong choice. Consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. If you cannot honour a withdrawal, for example because you are legally required to keep the record anyway, consent was never the right basis.

Paying an employee is performance of a contract. Keeping accounting records is a legal obligation. Sending a marketing newsletter is usually consent. Fraud prevention is often legitimate interests.

Pick the basis before you start processing, write it down in your RoPA, and tell people what it is in your privacy notice. Switching basis later because the first one became inconvenient is not permitted.