What is Consent under GDPR?

Consent is one of the six legal bases for processing personal data under the GDPR. Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them.

Requirements for Valid Consent

For consent to be valid under GDPR, it must meet the following criteria:

• Freely given: Consent must be voluntary and not coerced. There must be a genuine choice and control for individuals.
• Specific: Consent must be specific to particular processing activities. Blanket consent is not acceptable.
• Informed: Individuals must be provided with clear information about what they are consenting to.
• Unambiguous: Consent must involve a clear affirmative action, such as ticking a box or clicking a button. Pre-ticked boxes are not allowed.

How to Obtain Consent

Organizations must:

• Use clear and plain language that is easy to understand
• Separate consent requests from other terms and conditions
• Specify why the data is needed and what it will be used for
• Explain how individuals can withdraw their consent
• Keep records of when and how consent was obtained

Withdrawal of Consent

Under Article 7(3), individuals have the right to withdraw their consent at any time. Withdrawing consent must be as easy as giving it. Organizations must inform individuals of their right to withdraw consent before they give it.

When Not to Rely on Consent

Consent may not be appropriate in situations where there is a clear imbalance of power (such as employer-employee relationships) or where processing is necessary for the performance of a contract. In these cases, other legal bases may be more appropriate.