It is a myth that GDPR requires consent in all circumstances.
If it is necessary for you to obtain and use information about individuals:
- in connection with a contract;
- because another law requires you to do so;
- because it is in the vital interests (life or death matters) of someone to do so;
- because you have a justifiable legitimate interest to do so; or
- for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (mainly public bodies)
then you do not need consent, or any form of ‘signed agreement’, to that processing.
If none of the above apply and you rely solely on consent, then it must be a:
- freely given,
- informed, and
indication of the person’s agreement to that processing, given either by a statement or by a clear affirmative action. There is no room for ambiguity in obtaining or evidencing consent.
Remember, consent is transitory and can be withdrawn at any time.
Get in touch to discuss how we can help you with data protection compliance, or pop in for a chat at our offices at 16 Peel Road, Douglas on Monday 29 January between 10:30 - 12:00.