A question many people still have is that, regardless of whether legitimate interest is the basis for processing data, do organisations still have to gain consent where, for example, downloads or website form filling is required?
The Information Commissioners Office (ICO) states you can rely on other lawful bases apart from consent, i.e. where processing is necessary for purposes of that organisation’s legitimate interests. Thus, it is possible to use only this as the lawful basis for processing data.
GDPR states there need be only one lawful basis, with one not taking precedence over another. However, exceptions to applicability of lawful bases may change if special category data is involved. Further, consent should be the last option, given the ease with which it can be withdrawn (see Article 21).
Regarding website downloads, forms etc, there needs to be an assessment of context and intended use of the data before choosing whether to obtain consent or show it is needed for legitimate interest.