Consent to processing

What it means

Consent to the processing of personal data is a freely given, specific, informed and unambiguous indication of a person’s wishes allowing their data to be processed for a particular purpose. Under the GDPR it is one of six legal bases, not the only one and often not the most suitable.

Freely given means that refusing must not have adverse consequences and consent cannot be a condition of a service that does not need it. Specific means it relates to a clearly defined purpose, such as receiving a newsletter. Where there are several purposes, consent must be obtained for each separately.

Consent can be withdrawn at any time, and withdrawing must be as easy as giving it. Unlike legitimate interest or performance of a contract, consent suits situations where the person has a genuine choice, such as email marketing or analytics and marketing cookies.

How it works in practice

When reviewing clients’ data protection, we often find companies collecting consent where they do not need it, for example for processing employee data for payroll. The proper basis there is the contract and legal obligation. Unnecessary consent confuses matters, because if the person withdraws it, the company still has to process the data.

For newsletters we recommend double opt-in, confirming the subscription by clicking a link in an email. The company can then prove that the address owner really gave consent and has a record of when and how. That evidence is decisive at an inspection.

Consent must be separate from other terms. Pre-ticked boxes, consent hidden in general terms or wording like “by continuing you agree” are not valid consent. For children under a certain age, parental consent is required.

What to watch out for

Once consent is withdrawn, the company must stop processing for that purpose and, unless it has another basis, delete the data. Continuing to use them, for instance by still sending the newsletter, breaks the law. Withdrawal often comes with a request for erasure as well.

Blanket consent is another risk. A general consent to “marketing purposes and cooperation with partners” is not specific enough. The authority may not recognise it at an inspection, leaving the processing without a valid legal basis.