OneTrust Certified Privacy Professional Practice Exam

What is required for valid consent under GDPR?

1. It must be inferred from actions

2. It must be explicit and informed

3. It can be a part of terms and conditions

4. It must be given by a third party

The correct answer is: It must be explicit and informed

Valid consent under the General Data Protection Regulation (GDPR) is crucial for the lawful processing of personal data. For consent to be considered valid, it must be explicit and informed. This means that individuals must clearly understand what they are consenting to, including specific information about the data being collected and how it will be used. Explicit consent reflects a higher standard than simply implied or inferred consent, which could lead to misunderstandings about the data processing activities. Providing informed consent ensures that individuals are aware of their rights and the implications of their consent, allowing them to make choices based on a complete understanding of the situation. In comparison, other options do not satisfy the stringent requirements set by GDPR. Inferring consent from actions can lead to ambiguity, which is not acceptable. Including consent as part of terms and conditions can dilute the clarity and specificity of the agreement, as general opt-in clauses may not meet the necessary conditions for explicit consent. Lastly, consent must come directly from the individual whose data is being processed, rather than being provided by a third party, to ensure that the individual has control over their own personal information.