Consent or legitimate interest: how to choose the lawful basis
Every data processing activity needs a lawful basis from December 1, 2026, and processing without one is a serious infringement. Choosing between consent and legitimate interest is not a formality: each basis imposes different duties and fails in different ways.
The short answer
Consent is the general rule (Article 12, Law 19.628) and legitimate interest one of five alternatives (Article 13 letter d). Consent can be revoked at any time without cause; legitimate interest requires showing necessity and that no rights of the data subject are affected. The burden of proving lawfulness always falls on the controller.
The choice matters because each basis fails differently: consent fails when the data subject withdraws it or when it was not freely given; legitimate interest fails when the balancing test does not hold. The right basis is the one whose failure mode the processing can survive.
First check whether you need either one
Article 13 lists five sources of lawfulness without consent, and two of them cover most ordinary business processing: data necessary to perform a contract with the data subject or pre-contractual measures requested by them (letter c), and processing required by a legal obligation (letter b). Payroll, invoicing, delivering what the client bought: those activities rest on the contract, not on consent.
Asking for consent where the contract already provides the basis is not a harmless excess of caution. It creates a revocable basis where none was needed, and Article 12 presumes consent was not freely given when it is collected during the execution of a contract that does not require it. The error weakens the processing instead of reinforcing it.
What each basis demands
Consent
Free, informed and specific as to its purposes; given beforehand and unequivocally, by declaration or a clear affirmative act. Revocable at any time, without cause, through means as easy as those used to grant it, which must be expedite, reliable, free of charge and permanently available. The controller proves it exists.
Legitimate interest
The processing must be necessary to satisfy a legitimate interest of the controller or a third party, and must not affect the data subject’s rights and freedoms. The data subject can always demand to be informed of the processing and of the specific interest invoked. The balancing must hold on paper before it holds in front of the Agency.
When each one is the right choice
Consent fits when
- The processing exceeds what the contract or the law requires: marketing, profiling, sharing data with third parties.
- The data subject genuinely can say no without losing the service.
- The data is sensitive: Article 16 requires express consent as the general rule.
Legitimate interest fits when
- The processing serves a real operational need that a revocation should not be able to interrupt.
- Necessity can be documented: the purpose cannot reasonably be achieved with less data.
- The balancing against the data subject’s rights holds and is written down, ready to show.
Chilean law does not bring a list of accepted legitimate interests, and the Agency has yet to build its criteria. Whoever invokes letter d) today should assume the burden of a full balancing test: identified interest, documented necessity, and an analysis of the impact on the data subject. Where that record does not exist, the basis does not exist either.
What happens if the basis is wrong
Processing personal data without consent or another lawful basis, or for a purpose different from the one that justified collection, is a serious infringement fined with up to 10,000 UTM (Articles 34 ter and 35, Law 19.628). These rules become enforceable on December 1, 2026, with no grace period, as explained in what happens if your company is not ready.
Does every processing activity have its basis?
The Data Law diagnosis builds the inventory of processing activities, assigns the lawful basis each one supports and documents the balancing tests where legitimate interest is invoked.
Request the Data Law diagnosisFrequently asked questions
What is the general rule of lawfulness under Chilean law?
The data subject’s consent (Article 12, Law 19.628). Article 13 adds five bases that allow processing without consent: economic-obligations data under Title III, legal obligation, contract or pre-contractual measures, legitimate interest of the controller or a third party, and the defense of rights before courts or public bodies.
Can I use legitimate interest for marketing?
The law does not settle it by name. Letter d) of Article 13 requires the processing to be necessary to satisfy the legitimate interest and not to affect the data subject’s rights and freedoms, and the data subject can always demand to be told which interest is invoked. That balancing is case by case and will be shaped by the Agency’s criteria. Until that standard exists, documenting the balancing test is the only solid defense.
What happens if the data subject revokes consent?
Revocation is available at any time, without cause, through means equivalent to those used to grant it (Article 12). It has no retroactive effect: processing up to that day remains lawful, but future processing loses its basis. If the business cannot tolerate that interruption, consent was probably not the right basis.
Does sensitive data admit legitimate interest?
Not as a rule. Article 16 requires express consent for sensitive data, subject to the specific exceptions the law itself contemplates. The choice between consent and legitimate interest under Article 13 operates for non-sensitive personal data.
Who must prove that processing is lawful?
The controller, always. Article 12 requires it to prove consent and that data was processed lawfully, fairly and transparently; Article 13 closes with the same rule for the other bases: the controller must evidence the lawfulness of the processing.
Official sources
Transform Your Legal Challenges into Competitive Advantages
Discover how our innovative approach can drive your business
