Does the GDPR make consent mandatory?

No, the GDPR emphasizes that consent is one of the legal justifications for making data processing lawful. It also includes:

• The performance of a contract.
• Compliance with a legal obligation to which the data controller is subject.
• When processing is necessary to protect the vital interests of the data subject or another natural person.
• When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
• When processing is necessary for the legitimate interests pursued by the data controller or by a third party unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data prevail, especially when the data subject is a child.

However, the GDPR strengthens the rules applicable to consent.

What should I do to obtain valid consent?

Consent should be manifested through a clear and unambiguous written statement or affirmative action: NO pre-checked boxes or implicit consent.

Consent should be informed: Inform the data subject in plain language about the intended use of their data; the person must be aware of the consent given and its scope. Do not use negations.

Consent should be freely given and specific: It must be given for a specific purpose (e.g., for sending your commercial offers and not for YOUR offers and those of your partners). It should not be coerced (e.g., associating it with a discount, a gift, or the provision of a service when not necessary). Distinguish between consent for data processing and consent for terms and conditions, for example.

Inform the individual that they have the right to withdraw their consent at any time, emphasizing that it is as easy to withdraw consent as it is to give it.

How can I ensure that the proof of consent is correct?

We recommend that you keep records of what the person has consented to, the time of consent, and who has consented. Traceability of actions related to consent must be implemented: regarding consent, purposes, and revoked consents