Consent

In the case of express consent, the person must clearly and unequivocally state that they agree with the processing of their personal data. An example is checking a box on a form that says “I accept the processing of my data”.

However, the regulation requires explicit consent when special data categories are processed; when the processing involves automated individual decision-making, including profiling; and for international data transfers. Such processing requires more explicit consent from the data subject. For example, this may be in the form of a written and signed statement, although other forms are also acceptable, provided that the controller can verify that all the conditions for consent are met, such as: filling in an electronic form; sending an email; uploading a scanned document with the signature; and verbal statements.

No. The GDPR foresees certain situations in which consent must be explicit. This additional safeguard applies to the following cases: processing of special categories of data, automated decision-making, and international transfers.

It is an unequivocal statement or a clear affirmative action. For the purposes of the GDPR, pre-ticked boxes, implied consent or inaction are not valid consent.

Consent is not the only basis for processing personal data. The GDPR offers other possibilities for legitimising data processing, for example: compliance with a legal obligation or the exercise of public authority.

You have the right to withdraw it at any time. Withdrawing consent should be as easy as giving it. Withdrawal of consent does not have retroactive effect, and therefore processing carried out prior to withdrawal remains lawful.

No. This form of consent does not meet the requirements of the GDPR.