OneTrust Certified Privacy Professional Practice Exam

According to the GDPR, what is required for Consent to be considered valid?

1. It must be written

2. It must be as difficult to withdraw as to give

3. It must be explicit and documented

4. It must be easy to withdraw

The correct answer is: It must be easy to withdraw

For consent to be considered valid under the GDPR, it must be easy to withdraw, which ensures that individuals maintain control over their personal data. This requirement aligns with the core principles of transparency and user autonomy central to GDPR. By making the withdrawal process as simple as the process of granting consent, organizations respect the rights of data subjects, allowing them to change their minds about the use of their information at any time without facing unnecessary barriers. This characteristic is vital because it addresses the potential power imbalance between data subjects and organizations. If it is cumbersome to withdraw consent, individuals may feel compelled to continue consenting without truly understanding their choices. Therefore, ensuring that withdrawal is accessible and uncomplicated is crucial in fostering an environment of trust and respect between individuals and data handlers. In contrast, while consent can be documented, there is no strict requirement for it to be in written form. Additionally, while consent should be explicit, this is a broader condition covered by other requirements and not as specifically tied to the ease of withdrawal. Hence, these factors, though important, do not directly address the critical aspect of consent withdrawal outlined by GDPR.