A non-consent basis must still satisfy GDPR conditions: What is the decisive distinction?
Consent is not mandatory in every case, but any alternative lawful basis must satisfy its conditions and GDPR safeguards.
The question
A retailer subject to the EU GDPR plans to use loyalty-purchase histories for demand planning. Customers were not asked for consent to analytics, but the retailer documents another potentially applicable lawful basis, limits the data, and provides required information. What is the decisive distinction?
Preparing for AIGP? Take the free 5-min readiness quiz →
- The retailer can select legitimate interests without assessing customer impactsA legitimate-interests rationale requires appropriate assessment and balancing, not merely naming that basis.
- Demand planning is allowed whenever customers received any noticeNotice alone does not create a lawful basis or satisfy purpose, minimization, and accountability requirements.
- Consent is absent, so demand planning cannot proceedGDPR recognizes multiple lawful bases; absence of consent alone does not decide whether documented processing is permissible.
- A non-consent basis must still satisfy GDPR conditions and safeguards ✓Another lawful basis may support processing, but its conditions and GDPR principles must be documented and satisfied.
The trap
Ask whether another documented lawful basis fits the facts and whether its specific conditions were met. How to remember it
Consent is not mandatory in every case, but any alternative lawful basis must satisfy its conditions and GDPR safeguards.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- The new counseling prediction purpose must be assessed: Which distinction controls the reuse analysis? →
- Collect only data necessary for the recommendation purpose: Which distinction is decisive before collection? →
- Pseudonymized personal data: How should the records be classified for GDPR purposes? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.