Stratford upon Avon T: 01789 293259
Henley in Arden T: 01564 792261
Cheltenham T: 01242 228370
Birmingham T: 0121 200 0890

How should I obtain consent to process an individual’s data?


The Information Commissioner’s Office (ICO) has issued draft Guidance on obtaining an individual’s consent to the processing of their data in light of the incoming General Data Protection Regulation (GDPR). The consultation period for the draft guidance ended on 31 March 2017 and the ICO aims to publish finalised guidance by May 2017.

Data protection is complex and can be very difficult to understand, which is why formal guidance has been put in place which aims to advise on how to adapt current practices in order to ensure compliance with new regulations.

The ICO has recognised that the GDPR sets a high standard for consent which has resulted in the creation of this comprehensive guidance on this one aspect of the incoming GDPR. Some key points that the draft guidance highlights are:

  • Consent should put individuals in control, build customer trust and engagement, and enhance reputation.
  • Refresh current methods of consent if they don’t meet the GDPR standard.
  • Consent requires a positive opt-in by a statement or a clear affirmative action.
  • Explicit consent requires a very clear and specific statement of consent.
  • Keep your consent requests separate from other terms and conditions.
  • Be specific and have options to consent to different types of processing where appropriate.
  • Be clear and concise.
  • Name any third parties who will rely on the consent.
  • Make it easy for people to withdraw consent and tell them how.
  • Keep evidence of consent – who, when, how, and what you told people.
  • Keep consent under review, and refresh it if anything changes.
  • Public authorities and employers will find using consent difficult because they are in a position of power so it will be hard to show consent is freely given.
  • If consent is too difficult, look at whether another lawful basis is more appropriate.

This guidance is vital not only for businesses using consumer data but also for charities processing the data of donors. With the new regulations coming into force next year, all those implicated are encouraged to be aware of their responsibilities and understand how these changes will affect how they process data.

To view the full draft guidance please click here, or for more information on data protection for charities, you can read our comprehensive guide.

Understanding the impact of COVID-19 on business exits
Posted on 28th May 2020 in COVID-19 support and advice
Read full article
Join us for our online Bitesize Business Forum
Posted on 18th May 2020 in Events
Read full article
WATCH: Lodders’ first online Bitesize Business Forum
Posted on 24th April 2020 in COVID-19 support and advice
Read full article

If you’re a journalist looking for more information about Lodders, or to discuss a press release, please contact:
Diane Wood, V Formation on 07887 794507 or by email

Get in touch

For more information on data protection for charities, you can read our comprehensive guide. Alternatively, contact Mark Lewis on 01789 206132 or by email.