What is Consent?

As defined by the General Data Protection Regulation (GDPR), is a lawful basis for processing personal data. It means individuals must clearly and specifically agree to the processing of their personal data for particular purposes. This consent must be given through a deliberate and affirmative action. Such as ticking a box, clicking a button, or signing a form.

To be considered valid under GDPR, consent must meet several criteria:

• Freely Given: Must be given voluntarily, without coercion or pressure from the data controller.
• Specific: Individuals must be informed about the specific purposes for which their data will be processed.
• Informed: Individuals must be provided with clear and understandable information about the processing of their personal data. Including the identity of the data controller, the purposes of processing, any third parties involved, and their rights.
• Unambiguous: Must be given through a clear affirmative action, leaving no room for doubt or misinterpretation.
• Easily Withdrawn: Individuals should have the ability to withdraw their consent at any time. Additionaly, the process for withdrawing should be as simple as giving consent.

Due to the high protection level under GDPR, consent is a critical safeguard, ensuring individuals have full control over the processing of their most sensitive information. This includes health information, racial or ethnic origin, religious beliefs, political opinions, genetic data, and biometric data.

When Do I Need Consent?

Under the General Data Protection Regulation (GDPR), consent is required when processing sensitive personal data or when there's a high risk to individuals' rights and freedoms. This includes special categories of data like health information, racial or ethnic origin, religious beliefs, political opinions, genetic data, and biometric data.

Cross-border data transfers to countries outside the European Economic Area (EEA) that lack an adequacy decision from the European Commission also requires consent. In these cases, individuals must clearly and unambiguously agree to the transfer of their personal data, ensuring they have full control over their information and its associated risks.