Determine whether consent is actually the lawful basis
The term consent is often used loosely in lending applications. Under the GDPR, consent is one potential lawful basis for processing personal data, not a mandatory label for every credit bureau search. A controller must identify a suitable basis under Article 6 for each specific purpose. The possibility of relying on contractual necessity, legal obligation or legitimate interests depends on the facts and the statutory tests. It is incorrect to assume that a signed credit application makes all later processing consent-based. Where a separate national credit reporting law requires authorisation or permission, its conditions also need review. The creditor should distinguish those national requirements from GDPR consent rather than merging them.
Apply the GDPR test if relying on consent
GDPR Article 4(11) defines consent and Article 7 sets conditions for proving consent and allowing withdrawal. Consent must be freely given, specific, informed and unambiguous. Bundled agreement terms, preselected boxes and confusing descriptions are risky when processing genuinely depends on consent. Where accepting optional data sharing is made a condition of receiving credit despite not being necessary for the service, the assessment of free choice becomes particularly important. The consumer needs enough information to understand which data is accessed, by whom and for what purpose. A generic acceptance of the privacy policy is not automatically valid consent for every processing activity.
Separate creditworthiness data from open banking authorisation
A creditor may receive information through a traditional bureau, from the applicant, or through payment-account data services. Each channel can raise different legal questions. Under PSD2, an account information service relies on the payment service user's explicit consent for the service and must comply with the applicable payment services framework. This requirement is not identical to establishing the GDPR lawful basis for each controller's personal-data processing. Technical authorisation through a banking interface should not be described as unlimited permission to retain or resell transaction histories. Document the purpose, relevant service providers, access scope and period for every data flow.
Give accurate transparency and withdrawal information
A clear disclosure should explain the sources consulted, purposes, relevant recipients and the individual's applicable rights. GDPR Articles 13 and 14 address information obligations, with differences depending on whether data is collected from the person or another source. When processing rests on GDPR consent, the person must be able to withdraw consent as easily as it was given, without affecting processing that was lawful before withdrawal. Withdrawal does not necessarily erase data that the controller must retain under another legal basis. Avoid promising that withdrawing access will cancel a completed credit agreement or remove all previous information unless that conclusion follows from the governing law and actual process.
Consider credit bureau access and overseas distinctions
Some Member States regulate who may consult credit databases and the conditions under which access is allowed. Directive (EU) 2023/2225 Article 19 also addresses cross-border access to databases used for creditworthiness assessment. These rules should be considered alongside the GDPR rather than replaced by a generic consumer permission. In the United States, the FCRA uses a permissible-purpose framework for consumer reports, which is distinct from EU GDPR consent and may allow specified credit-related purposes without a stand-alone consent form. A multinational lender needs separate country and product analyses. Borrower-facing explanations should not copy a US report authorisation into an EU workflow as though the rules matched.
Retain evidence without expanding the purpose
Operational evidence should link the applicant, data source, lawful basis assessment, notice version, authorised request and relevant date. If consent is used, retain the specific statement shown, the affirmative action and any subsequent withdrawal. Review access logs for reuse of bureau or transaction data beyond the documented purpose. Separate permission to view a bank account from permission to use the information for unrelated marketing or future model development. Track vendor access, retention and deletion rules, especially after an application ends. Reassess the process when a new open banking provider or national bureau is introduced, because the legal basis and technical data scope may change. Consent records should not be assessed in isolation from application design. For example, when a borrower declines an optional transaction-data connection, the interface should accurately describe alternative evidence channels rather than automatically portraying that choice as refusal of mandatory lending checks. Review whether the available alternatives and any change to the offer are consistent with the documented lawful basis. Test the withdrawal path using real account permissions and verify that a disconnected provider stops fresh collection as required. Exceptions for retained records need specific legal justification, clearly distinguished from any continued permission to fetch new data.
Frequently asked questions
Does obtaining credit data always require GDPR consent?
No. GDPR consent is only one possible lawful basis; the applicable basis and any national access requirements must be assessed.
Is PSD2 explicit consent identical to GDPR consent?
No. PSD2 account-information authorisation and the GDPR lawful-basis analysis are distinct.
Can consent be withdrawn?
Where GDPR consent is the basis for processing, Article 7 provides a right to withdraw it, without reversing prior lawful processing.
Primary sources
GDPR Regulation (EU) 2016/679 ↗Directive (EU) 2023/2225 ↗CFPB: FCRA permissible purposes ↗CFPB: Regulation V direct disputes ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.