Consent has become the centre of almost every privacy discussion.
I'm not convinced it should be.
Under POPIA, consent is only one lawful basis for processing personal information. It sits alongside contractual necessity, legal obligation and legitimate interest.
Consent matters.
It just isn't where the conversation should begin.
Before an organisation asks for consent, a more fundamental question should already have been answered.
Is the organisation entitled to ask?
The sequence matters.
• Authority – is the organisation entitled to act?
• Purpose – what is it entitled to do?
• Lawful basis – on what legal basis may it do so?
• Processing – what information may now be processed?
Consent may form part of that decision.
It should never replace it.
This becomes even more important as AI systems begin acting on behalf of organisations.
An AI agent cannot invent authority.
It can only operate within the authority delegated to it and the rules that govern its actions.
When we establish authority before processing, privacy becomes more than compliance.
It becomes governance.
**