Consent has become the centre of almost every privacy discussion. Under POPIA, however, consent is only one lawful basis for processing personal information — it sits alongside contractual necessity, legal obligation and legitimate interest. Before an organisation asks for consent, a more fundamental question should already have been answered: is the organisation entitled to ask?
The sequence
Authority — is the organisation entitled to act? Purpose — what is it entitled to do? Lawful basis — on what legal basis may it do so? Processing — what information may now be processed? Consent may form part of that decision. It should never replace it.
Why this matters more as AI acts on our behalf
An AI agent cannot invent authority. It can only operate within the authority delegated to it and the rules that govern its actions. When authority is established before processing begins, privacy becomes more than a compliance checkbox — it becomes governance.