Consent and the lawful basis: how a public body can use Essence
A person's choice to share from their vault is not a public body's lawful basis. Essence records the two apart: the grant the person controls, and the Article 6 basis the organisation declares.
A council, an agency or a department looking at Essence meets the word consent on almost every screen. Nothing leaves a person's vault unless a consent record says it may. Yet a public body will rarely rest its own processing on consent. So the first question a government reader asks is a fair one: if consent is not your lawful basis, what is this consent doing?
Why consent rarely fits a public body
The ICO's guidance on consent says that "consent will not usually be appropriate if there is a clear imbalance of power between you and the individual", and that "this will be a particular issue for public authorities and employers". People who depend on a service may feel they have no real choice. The guidance draws the conclusion itself: "If you are a public authority or are processing employee data, or are in any other position of power over an individual, you should look for another basis for processing, such as 'public task' or 'legitimate interests'." It does not put this as an absolute rule, but the direction is plain.
The ICO's guidance on public task says that basis is "most likely to be relevant for public authorities". For many public bodies, the realistic bases under Article 6 of the UK GDPR are public task and legal obligation.
Two decisions, not one
Sharing through Essence involves two separate decisions, made by different people.
The first is the person's. They decide which fields from their own vault to share with which organisation, for what purpose and until when. Essence records that decision as a consent grant, one record for every shared field, and the person controls it: they can withdraw a single field or the whole grant. This is control over disclosure from the vault, and it is how the platform decides whether data may leave. How consent works at Essence (essence.digital/knowledge/how-consent-works) covers it in full.
The second is the organisation's. Once the data arrives, what the service does with it needs a lawful basis of its own under Article 6. For a public body that is typically public task or legal obligation. That basis belongs to the organisation, which identifies it, documents it and answers for it.
Keeping the two apart matters because they behave differently. Run them together and a person may believe that withdrawing will stop processing it does not stop, or a service may believe that a share gives it a footing it does not.
What a grant records
Since our August release, a consent grant can record the Article 6 basis the processing rests on, why that basis applies, and how long the recipient may keep the data once the grant ends. Any of the six bases in Article 6(1) can be recorded, and a reason is required whenever one is. Retention has no default: it is stated, even when the answer is no longer than the grant itself. All three are fixed when the grant is made and cannot be edited afterwards. A different basis means a new grant, which means asking the person again.
Where a grant records no basis, the platform says "not declared". It does not fill in a default, and it does not assume consent.
Both the person and the organisation can read a receipt for the grant, which shows the basis as its article reference, the reason given, the retention period and what withdrawal does.
Since our October release, an organisation can also publish its own declaration of basis, reason and retention on the consent-policy templates it offers people in its consent console. The platform treats this as the organisation's statement, not a choice for the person to make.
Some processes need a person's agreement before there is anything to share, such as asking a university to reissue a transcript. A purpose-scoped grant covers this: one named organisation, one purpose from a closed list, an end no more than 366 days away, and withdrawal only by the person who gave it.
What withdrawal does under public task or legal obligation
The recorded basis decides what withdrawal means, and the platform states it in a plain sentence beside the control the person uses to withdraw.
Withdrawing always stops Essence disclosing anything more. If the grant rests on consent, the processing must also stop. If it rests on public task or legal obligation, the organisation may keep using what it already holds under its own authority; the platform tells the person so. Where no basis was recorded, it says it cannot tell whether the organisation's own processing stops.
Which of those rights applies depends on the basis. The ICO's guidance says that under public task people "have the right to object", though "this is not an absolute right", and that "the UK GDPR doesn't give people the right to erasure or data portability if you're using public task as your lawful basis". Under legal obligation, it says the individual "has no right to erasure, right to data portability, or right to object".
What stays with the organisation
The choice of lawful basis, and the assessment behind it, belong to the organisation and its data protection officer. Essence records what the organisation declares, holds it fixed and shows it to the person, so the basis is visible to everyone it affects.
Where the shared data is held, and what crosses a border, is set out in Where your data lives (essence.digital/knowledge/where-your-data-lives). How the platform protects the data itself is set out in Security at Essence (essence.digital/knowledge/security-and-assurance-today).
For a public body, this means the person's control over their vault and the service's own lawful basis sit side by side in one record, each visible and neither standing in for the other. If you are working out how a service of yours would declare its basis on Essence, we would be glad to talk it through.
Last reviewed 10 October 2026