GDPR Article 7 — Conditions for consent
Enforced by: ICO (UK) / National DPAs
Current as of May 25, 2018
Plain Language Summary
Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes don't count. Withdrawing consent must be as easy as giving it.
Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. It shall be as easy to withdraw consent as to give it.
When assessing whether consent is freely given, utmost account shall be taken of whether the performance of a contract is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.