Every processing activity must rest on one of the six GDPR legal bases: consent, contract, legal obligation, protection of vital interests, public task, legitimate interests. It is chosen before the processing, per purpose, and documented. Consent is not the default basis.
Example
Fulfilling an online order: legal basis "contract".