Consent (legal basis)

Under the GDPR, PII can only be collected and/or processed under a ‘legal basis’ (or simply, only if there is a reasoning for the processing).

A Processor or Controller can rely on gaining the customer’s consent as a reasoning for data processing.

For consent to be compliant, it must be:

• Freely given by the individual;

• Specific of what PII will be processed, how and why;

• Communicated to the individual so they understand what, how and why PII will be processed (informed); and,

• A clear approval (an unambiguous indication of an individual's agreement) to the processing of their PII.