ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained. Background to consent To satisfy the first data protection principle in the DPA 1998 as derived from the Directive 95/46/EC (the Data Protection Directive), data controllers must be able to demonstrate, among other matters, that they have met: • one of the conditions for processing personal data under DPA 1998, Sch 2, and • if the data constitutes sensitive personal data, then in addition to this, one of the conditions for processing sensitive personal data under: ◦ DPA 1998, Sch 3; or under ◦ the Data Protection (Processing of Sensitive Personal Data) Order 2000, SI 2000/417, which sets out additional conditions which allow the processing of sensitive personal data in limited circumstances. For more information, see: Further conditions for processing special category personal data—Data Protection Act 2018: Encylopaedia