Consent to the processing of personal data is one of several legal bases on which data can be processed. Companies often require it even where another basis would suffice – performance of a contract, a statutory obligation or legitimate interest – thereby unnecessarily complicating their operations, because consent can be withdrawn at any time. If consent is used, it must meet strict conditions: it must be freely given, meaning it must not be a condition for a service that does not require it, specific to the given purpose, informed and demonstrable. Demonstrability means being able to prove who consented, when, in what manner and to exactly what. Withdrawal must be as easy as giving consent and must be reflected in all systems. Discuss the choice of legal basis with a lawyer before collecting data.
See also: Cookie banner, Data subject rights, Legal basis for email marketing.
