Why Consent Is Not the Default Lawful Basis
Consent is the lawful basis most people name and the one least often correct. Processing usually rests on contract, legal obligation, or legitimate interests, and consent has to be freely given, specific, and withdrawable, which it rarely is between an employer and an employee. Choosing the wrong basis is itself the failure.
That misunderstanding produces most of the practical errors staff make: consent forms collected where none was needed, and processing continued after a withdrawal that never applied. Teaching the bases in order of frequency, rather than starting with consent, corrects it in one scene. Kept out of the video entirely is records of processing and DPIA content: they name systems, vendors, and data flows, and belong in the register rather than in a training video.
The template covers it in nine scenes: one on what counts as personal data, two on the lawful bases in order of how often they apply, one on why consent is the exception, two on data subject rights and the response clock, one on cross-border transfer limits, one on how to recognise a suspected breach, and one on reporting it within the internal deadline.
