Process personal data lawfully | European Data Protection Board

Your organisation may decide to rely on consent for the processing of personal data.If a data controller uses consent as a legal basis for the processing of personal data, they must ensure that this consent is freely given, informed, specific and unambiguous. This means that individuals must have a genuinely free choice regarding whether or not they agree with the processing of their personal data; they need sufficient information so that they can understand which data is processed, for what purpose, and how this is done; and they need to be able to freely withdraw their consent (without any negative consequences) if they change their mind later on.If the organisation has to process the data and cannot truly enable individuals to withdraw their consent, this is an indication that consent is not the appropriate legal basis of the processing, and there is a need to assess if another legal basis could be applicable. Conditions for consent Free Consent is freely given when individuals are...