Consent is one of six legal bases for an organization to process someone’s personal data under the GDPR. However, under the GDPR, consent may be revoked at any time. Therefore, organizations that prefer consistent access to personal data should rely on the other legal bases.