A common mistake to make with GDPR is that you need to request consent in order to process data, however, while this is one option it is only one of the six lawful basis for processing personal data.
There will be times when consent is the most suitable but it is often the least preferable basis.