Task 4 — Consent Management
Consent only counts if you can prove it — and withdrawing it is as easy as giving it.
For every processing activity based on consent, document how consent is obtained, recorded and withdrawn. Without proof, the processing has no legal basis.
- Obtaining: freely given, specific, informed and given by a clear action — no pre-ticked boxes, no consent hidden in terms and conditions
- Recording: who consented, when, to which text (version) and through which channel, so it can be proven later
- Withdrawing: as easy as giving it, and processing stops after the withdrawal
- Special rules: e.g. for children, sensitive data or electronic marketing
- Obtained: unticked checkbox on the website with a short text and a link to the privacy notice, confirmed by e-mail (double opt-in)
- Recorded: e-mail address, date and time of sign-up and confirmation, version of the consent text, source "website footer"
- Withdrawn: unsubscribe link in every newsletter, takes effect immediately; the address is kept on a suppression list only
- Not valid: adding all customers to the newsletter because they once bought something