[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F7":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","7","Article 7","Conditions for consent",100,"General Data Protection Regulation","**What it asks for.** Where processing relies on consent, the controller must be able to show that consent was given. A request for consent in a written declaration covering other matters must be clearly distinguishable, intelligible and in plain language. Individuals can withdraw consent at any time, as easily as they gave it, and whether consent is freely given depends on factors such as whether a service is made conditional on unnecessary consent.\n\n**In practice.** Organisations record who consented, when, to what and how, keep the wording shown at the time and offer a simple withdrawal route. Consent requests are separate from terms and conditions and are not bundled. Evidence includes consent logs, versioned consent texts and records showing withdrawals are honoured across systems.\n\n**Common gaps.** Withdrawal is often harder than giving consent, or is not propagated to downstream systems. Consent is also used where a power imbalance means it cannot be freely given.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_7","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":23,"title":24,"published_at":25},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":27,"title":28,"published_at":29},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":31,"title":32,"published_at":33},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","2026-10-13T12:20:47.783+00:00",{"slug":35,"title":36,"published_at":37},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":39,"title":40,"published_at":41},"eu-parliament-members-undermining-gdpr-know-who-represents-your-privacy","EU Parliament Members Undermining GDPR: Know Who Represents Your Privacy","2026-10-12T04:20:19.966+00:00",{"slug":43,"title":44,"published_at":45},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","2026-10-11T22:20:30.87+00:00",{"slug":47,"title":48,"published_at":49},"croatian-gambling-operator-fined-259m-for-biometric-data-gdpr-violations","Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations","2026-10-11T22:20:17.238+00:00",{"slug":51,"title":52,"published_at":53},"cjeu-rules-vague-partners-consent-invalid-under-gdpr","CJEU Rules Vague 'Partners' Consent Invalid Under GDPR","2026-10-08T10:20:54.336+00:00",{"slug":55,"title":56,"published_at":57},"greek-dpa-fines-dei-and-call-center-partners-880k-for-gdpr-marketing-violations","Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations","2026-10-05T10:20:23.718+00:00",{"slug":59,"title":60,"published_at":61},"cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","2026-09-23T10:20:56.329+00:00",{"slug":63,"title":64,"published_at":65},"isp-fined-600k-for-vague-consent-practices-in-direct-marketing","ISP Fined €600K for Vague Consent Practices in Direct Marketing","2026-09-23T09:20:37.418+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",38,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",36,{"slug":78,"name":79,"problem":80,"stories":81},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",10,{"slug":83,"name":84,"problem":85,"stories":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":88,"name":89,"problem":90,"stories":86},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":92,"name":93,"problem":94,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[96,102,108,113,119,123,128,133],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",83,{"family":103,"item":104,"code":105,"title":106,"together":107},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",78,{"family":5,"item":109,"code":110,"title":111,"together":112},"6","Article 6","Lawfulness of processing",59,{"family":114,"item":115,"code":116,"title":117,"together":118},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",50,{"family":120,"item":104,"code":121,"title":121,"together":122},"itil","ITIL",45,{"family":5,"item":124,"code":125,"title":126,"together":127},"5","Article 5(1)(f)","Principles relating to processing of personal data",44,{"family":5,"item":129,"code":130,"title":131,"together":132},"13","Article 13","Information to be provided where personal data are collected from the data subject",34,{"family":134,"item":135,"code":136,"title":137,"together":138},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",27]