What it asks for. Article 4 defines the key terms used throughout the regulation, including personal data, processing, controller, processor, pseudonymisation, personal data breach and consent. Point 11 defines consent as a freely given, specific, informed and unambiguous indication of the individual's wishes, given by a statement or by a clear affirmative action.
In practice. Organisations use these definitions consistently in policies, contracts and assessments. For consent, that means no pre-ticked boxes or silence, separate consent for distinct purposes, enough information for the person to understand what they agree to and a genuine choice. Evidence includes consent interfaces, the wording used and records that show an affirmative action.
Common gaps. Many teams interpret personal data too narrowly, overlooking identifiers such as device IDs or IP addresses. Consent is also frequently bundled or implied, which fails the definition.