Not always. Consent is the main ground, but Section 7 allows 'legitimate uses' without consent, for example: when you voluntarily give data for a stated purpose and do not object, for government benefits and services, to comply with a law or court order, for medical emergencies, during disasters, and for employment purposes. Outside those cases, the organisation must get your consent.