Processing personal data—standard of consent
Processing personal data—standard of consent

The following Risk & Compliance practice note provides comprehensive and up to date legal information covering:

  • Processing personal data—standard of consent
  • What is consent?
  • Do you need consent?
  • When is consent not appropriate?
  • Standard consent—personal data other than special category data
  • What is valid consent?
  • What is clear affirmative action?
  • Freely given consent
  • Capacity to consent
  • Children
  • More...

Processing personal data—standard of consent

This Practice Note is based on the UK General Data Protection Regulation (UK GDPR) and consent guidance published by the Information Commissioner’s Office (ICO).

Consent is unlikely to be the default ground for processing personal data under the UK GDPR and organisations will need to consider whether any other lawful grounds are more appropriate from a legal and operational perspective—see below: Do you need consent? and Practice Note: Processing personal data—lawful processing.

What is consent?

Consent is defined as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data.

Consent must therefore be:

  1. freely given

  2. specific

  3. informed

  4. unambiguous

There are two levels of consent depending on the type of data you are processing:

  1. standard consent, which is required to process standard personal data

  2. explicit consent, which is required to process special category (sensitive) personal data

For guidance on the difference between standard and explicit consent, see below: Explicit consent—special category data.

Do you need consent?

Consent is only one of the bases on which you can lawfully process data under the UK GDPR. You should always consider whether an alternative lawful basis for processing personal data exists. There are five alternatives:

Legal basis under Art 6ICO guidance, example

Popular documents