The “consent of the data subject” is any manifestation of free, specific, informed, and unequivocal will by which the data subject agrees, by means of a clear statement or affirmative action, that their personal data may be processed (meaning that implicit or presumed consent is not allowed – for example, no pre-checked boxes on a form).
It doesn’t have to be “documented in writing” necessarily, nor is the “written form” required, although this is a suitable way to ensure the unambiguous nature and explicitness of the consent.
Furthermore, the data controller must always be able to demonstrate that the data subject has given their consent for each processing activity.
Find out more about Legal bases for processing of personal data.
