GDPR - Consent

The GDPR makes it much harder to imply consent. The standard will now require clear affirmative action (such as a written, electronic or oral statement) establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to their personal data being processed.

The burden of showing that consent was validly obtained and freely given will fall on the data controller.

For consent to be informed, the data subject should be aware of the data controller's identity and the intended purposes of the processing.