Data subjects must give their consent freely when controllers are processing their data. This can be done by a statement or by a clear affirmative action which signifies agreement to the processing of personal data relating to him or her. Controllers must demonstrate consent was obtained using clear and plain language in a format such as:

• Signing a declaration form
• Tick box on form with consent wording
• Sending an email
• Selecting Yes/No options on a form with consent wording

The data subject has the right to withdraw his or her consent at any time.

GDPR requires the organisation to keep evidence of consent (accountability).

Iprotectu has GDPR awareness training for managers on the legal requirements of GDPR.