A company is processing my data without my consent. Is this always illegal under GDPR?

What the Law Says

The General Data Protection Regulation (GDPR) does not require consent for all personal data processing. Instead, it sets out six lawful bases in Article 6 — only one must apply for processing to be lawful.

Consent is only one option. A company may lawfully process your data without your consent if it relies on another basis — for example, to perform a contract with you, comply with a legal obligation, protect someone’s life (vital interests), carry out a task in the public interest, or pursue its legitimate interests — provided those interests are not overridden by your rights and freedoms.

Article 6(1) explicitly lists these conditions. Importantly, if a controller relies on legitimate interests (Article 6(1)(f)), they must conduct and document a balancing test — weighing their interests against your fundamental rights.

Also, special category data (e.g., health, religion, biometrics) has stricter rules under Article 9 and generally requires an additional condition beyond Article 6 — such as explicit consent or substantial public interest.

Statutory Text

Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent... (b) processing is necessary for the performance of a contract... (c) processing is necessary for compliance with a legal obligation... (d) processing is necessary to protect the vital interests of the data subject or of another natural person... (e) processing is necessary for the performance of a task carried out in the public interest... (f) processing is necessary for the purposes of the legitimate interests pursued by the controller...

— Regulation (EU) 2016/679, Art. 6(1)

Sources