Is consent always required, or are there exceptions?

Consent is the primary basis, but the Act also recognises certain legitimate uses. These include situations where an individual voluntarily provides data for a specified purpose and has not indicated objection, performance of State functions and provision of subsidies, benefits, services, certificates, licences or permits, compliance with law or court orders, responding to medical emergencies and threats to life, providing medical treatment or health services during an epidemic or public health threat, ensuring safety during disasters or breakdowns of public order, and specified employment purposes. These are defined categories, not a general escape route.