Article 7 of GDPR outlines the conditions needed for a data subject to provide valid consent authorizing data controllers to collect, process and store personal data.
Processing based on consent (Article 7(1) GDPR)
When an organization processes personal data on the basis of the consent of a data subject, the company must be able to justify and prove that the data subject has consented to the processing of personal data.
When consent is given for multiple purposes (Article 7(2) GDPR)
When a person is asked to give consent in a declaration that concerns other matters as well, companies must make sure that the consent for the processing of personal data is made very explicit and clearly distinguishable from the other matters.
This way, data subjects are offered the opportunity to become aware of the data processing purpose and provide their consent knowing to what they are consenting to.
Right to withdraw consent (Article 7(3) GDPR)
The law allows individuals to be able to withdraw their consent at any given time.
When consent is withdrawn, the processing activities performed prior to the withdrawal of the consent will remain valid.
Also, companies must allow individuals to withdraw consent in an easy way.
In other words, withdrawing consent should be as easy as it was when giving consent.
Assessing the consent (Article 7(4) GDPR)
As a measure to assess if a person’s consent was freely given, the authorities should consider if an organization received unnecessary data as a condition to render their services or perform their duties.
| Section / Point | Summary | Notes / Examples |
|---|---|---|
| General requirement | Consent must be **freely given, specific, informed, and unambiguous**. | Users must clearly agree to the use of their data; silence or pre-ticked boxes are not valid. |
| Clear indication | Consent requires a **clear affirmative action** by the data subject. | Ticking a box, clicking “I agree,” or another active step counts. |
| Right to withdraw | Data subjects must be able to **withdraw consent at any time**, easily and without penalty. | Include an unsubscribe link in marketing emails or a settings option in apps. |
| Separate consent | Consent for **different processing activities** must be collected separately. | Marketing emails vs. sharing data with third parties must have separate opt-ins. |
| Proof of consent | Controllers must be able to **demonstrate that consent was obtained**. | Keep records of when and how consent was given. |
| Children’s consent (cross-reference with Article 8) | Special rules apply for obtaining valid consent from children under a certain age. | In the UK, parental consent is required for children under 13 for online services. |
Article 1 – Article 2, Article 3, Article 4, Article 5, Article 6, Article 7 , Article 8>