The data subjects freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Consent is defined in Art. 4 (11) GDPR.

Consent is one of the six legal basis in Art. 6 GDPR for the processing of personal data. It is not an appropriate legal basis when there is a clear imbalance between the data subject and the controller, e.g. when the data subject is an employee and the controller the employer.

Consent must derive from an active choice, e.g. ticking a box when visiting an internet website. The controller must be able to demonstrate that consent was given. As a result, a pre-ticked box cannot constitute consent.

Additionally, according to Art. 7 (3) GDPR it should always be as easy to withdraw a given consent as it is to give it in the first place.