Consent

One of the GDPR's six lawful bases for processing personal data. Valid consent must be freely given, specific, informed and unambiguous — and given by an active step, such as ticking a box that is not pre-ticked. The data subject can withdraw consent at any time, and doing so must be as easy as giving it. The company must be able to document that consent was properly obtained, and in employment relationships consent is rarely suitable because the imbalance of power makes voluntariness doubtful.