When do I need consent for data protection purposes?

read titleRead full title
Published on LexisPSL on 04/12/2013

The following Information Law Q&A provides comprehensive and up to date legal information covering:

  • When do I need consent for data protection purposes?
  • Background
  • How to get consent
  • Direct marketing and consent
  • Sensitive personal data and consent
  • Developments to consent requirement


The Data Protection Act 1998 (DPA 1998) requires all processing of personal data to be 'fair and lawful'. Additionally, that processing must satisfy at least one of the conditions set out in DPA 1998, Sch 2. For the majority of businesses the most significant of these are:

  1. the data subject has given his consent to the processing

  2. the processing is necessary for the performance of a contract to which the data subject is a party (or for the taking of steps at the request of that data subject with a view to entering into a contract)

  3. the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject

So, an initial consideration of the alternatives to consent should often be considered. Specific requirements r

Related documents:

Popular documents