[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpt-4":3},{"item":4,"lessons":18,"controls":51,"related":66},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pt-4","PT-4","Consent",8,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must implement tools or mechanisms that allow individuals to consent to the processing of their personally identifiable information before collection, so that they can make informed decisions.\n\n**In practice.** For European organisations this connects to GDPR consent requirements where consent is the lawful basis, and to ePrivacy rules on cookies. Good practice is clear, granular consent requests, records of what each person agreed to and when, and easy withdrawal. Auditors look for consent interfaces, consent logs and evidence that withdrawals are acted on in downstream systems.\n\n**Common gaps.** Consent banners that make refusal hard, bundled consents and withdrawals that never reach marketing or analytics systems are frequent problems. Consent is sometimes relied on where another lawful basis would be more appropriate.","Implement [Assignment: organization-defined tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.\nDiscussion: Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,39,43,47],{"slug":21,"title":22,"published_at":23},"bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","2026-10-09T08:20:27.832+00:00",{"slug":25,"title":26,"published_at":27},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight--1790151773088","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","2026-09-23T08:22:52.898+00:00",{"slug":29,"title":30,"published_at":31},"vague-consent-language-violates-gdpr-eu-court-rules","Vague Consent Language Violates GDPR, EU Court Rules","2026-09-22T12:22:23.843+00:00",{"slug":33,"title":34,"published_at":35},"bbva-italy-fined-55m-for-ignoring-user-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Requests","2026-09-14T14:21:10.04+00:00",{"slug":37,"title":26,"published_at":38},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight-failures","2026-07-28T12:20:20.459+00:00",{"slug":40,"title":41,"published_at":42},"banco-de-sabadell-fined-for-ignoring-customer-marketing-opt-out","Banco de Sabadell Fined for Ignoring Customer Marketing Opt-Out","2026-07-24T12:22:09.015+00:00",{"slug":44,"title":45,"published_at":46},"bankia-fined-50000-for-ignoring-client-opt-out-on-marketing-communications","Bankia Fined €50,000 for Ignoring Client Opt-Out on Marketing Communications","2026-07-24T12:21:55.287+00:00",{"slug":48,"title":49,"published_at":50},"tiger-media-fined-72k-for-unlawful-advertising-cookies-and-missing-eu-representative","Tiger Media Fined €72K for Unlawful Advertising Cookies and Missing EU Representative","2026-07-24T12:21:22.754+00:00",[52,57,62],{"slug":53,"name":54,"problem":55,"stories":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":58,"name":59,"problem":60,"stories":61},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":63,"name":64,"problem":65,"stories":61},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[67,73,79,83,89,93,97,101],{"family":68,"item":69,"code":70,"title":71,"together":72},"cis","3","Control 3","Data Protection",7,{"family":74,"item":75,"code":76,"title":77,"together":78},"gdpr","6","Article 6","Lawfulness of processing",6,{"family":74,"item":80,"code":81,"title":82,"together":78},"21","Article 21","Right to object",{"family":84,"item":85,"code":86,"title":87,"together":88},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",5,{"family":74,"item":90,"code":91,"title":92,"together":88},"7","Article 7","Conditions for consent",{"family":74,"item":94,"code":95,"title":96,"together":88},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":98,"item":99,"code":100,"title":100,"together":88},"itil","overview","ITIL",{"family":68,"item":102,"code":103,"title":104,"together":105},"15","Control 15","Service Provider Management",3]