Consent - when do you need it and how must it be gathered

Schools must always have a legal basis for processing personal data. This means they must have a legitimate reason for gathering and processing the data. There are 6 legal basis for processing data - one of which is consent.

Consent to process data should only be requested if another legal basis does not already exist. i.e. if you have already have a contract or a legal obligation to process data then you should not also ask for consent. (Using a Record of Processing Activity should allow the school to identify the legal basis for all its processing activity and indicate when consent is required).

When consent is required the school must be able to evidence what consent has been given for and that it has been gathered appropriately. i.e. keep a record of the consent for future reference.

The person giving consent must understand the purpose of the data processing activity, must give consent freely and must be able to withdraw consent without detriment.

#consent#GDPR#Article7