Consent

Valid consent must be free, specific, informed, and unambiguous. It requires a clear affirmative action by the individual or data subject, signifying agreement to the processing of personal data for a specified purpose. It should not be bundled with unrelated terms or forced as a condition for service delivery unless the data is strictly necessary to provide that service.

A robust consent management system should integrate with user interfaces to capture granular approvals and refusals. It should maintain detailed logs of who consented, when, and to what version of the privacy notice. It must also facilitate easy consent withdrawal and communicate revocations to downstream systems so processing stops where consent is the legal basis.

Informed consent requires that the organization or data controller provide a clear notice before requesting consent. This notice should be in plain language and disclose the types of data collected, the specific purposes of processing, the identity of the organization, the rights of the individual (including withdrawal), and contact information for questions or complaints.

Individuals must be able to withdraw their consent at any time. In many regimes and best-practice guidance, the process for withdrawal should be as easy as the process for giving consent. If consent was given via a single click in an app, withdrawing it should be available through similarly simple in-app controls rather than requiring extra hurdles.

Organizations should maintain an audit trail that demonstrates valid consent was obtained. Common records include the identity (or account) of the consenting individual, the date and time of consent, the notice or form presented at that time (including version), and the specific purposes agreed to. These records support accountability and are often requested during audits or investigations.

Consent is not required when another lawful basis applies. Common examples include processing necessary to perform a contract, meet legal obligations, protect vital interests in emergencies, carry out tasks in the public interest or under official authority, or pursue legitimate interests where permitted and balanced against individual rights. The appropriate basis depends on context and jurisdiction.

To verify that consent is freely given, organizations should ensure there is no coercion or undue influence and that individuals have a real choice. A key test is whether the person can refuse or withdraw consent without unfair detriment. If a service is denied because a user refuses optional processing that is not necessary to provide the service, consent may not be considered freely given.

Consent may be invalid if it is not informed (the person did not understand what they agreed to), not freely given (coerced or tied to non-essential processing), too vague (broad or undefined purposes), or obtained through deceptive patterns. Failing to provide a practical withdrawal mechanism can also undermine compliance where consent is relied upon.