Permission given by data subjects for specific processing of their personal data.
Consent is one lawful basis for processing under GDPR—freely given, specific, informed, and unambiguous agreement by the data subject. Consent must be demonstrable, easily withdrawn, and not bundled with other terms. It cannot be implied from silence or pre-ticked boxes. Consent is appropriate for marketing but often not the best basis for other processing where contract, legal obligation, or legitimate interests may be more appropriate.
Why It Matters
The DSC Perspective:
Consent seems straightforward but has strict requirements. It can be withdrawn, potentially stopping processing. Consider whether contract or legitimate interests might be more appropriate bases than consent.