Consent

“A signature records a moment. Consent describes the conditions under which a choice was genuinely possible. ”

Consent appears simple on paper. An enumerator reads a statement, a participant signs or taps a box and data collection begins. The form becomes evidence that permission was obtained. Yet a signature cannot show whether the person understood the purpose, had a real alternative, agreed to each use or believed refusal would affect payment, support or market access.

The General Data Protection Regulation defines consent as a freely given, specific, informed and unambiguous indication of the data subject's wishes by a statement or clear affirmative action. Each element is cumulative. If the choice is coerced, bundled, vague, poorly explained or assumed from silence, the label consent does not make it valid. Freely given is difficult where power is unequal.

A farmer may be asked for household data by the only buyer available.

A worker may be asked to participate in a survey organised by the employer. A beneficiary may believe refusing will affect services. The European Data Protection Board cautions that imbalance can make consent inappropriate because the person may not have a genuine choice without detriment. Specific means the person agrees to defined purposes.

Consent to register for a programme is not automatically consent to share data with clients, train an algorithm, publish a case study or retain the record for future research. Bundled consent hides separate decisions inside one yes. Where purposes are distinct, choices should be distinct. Informed means more than reading legal text.

People need clear information about who controls the data, what will be collected, why, with whom it will be shared, how long it will be kept, what risks exist and how rights can be exercised.

Language, literacy, disability, cultural convention and time all affect understanding. Information should be tested with intended users rather than judged only by lawyers. Unambiguous requires affirmative action. Pre-ticked boxes, inactivity or participation without an explicit choice are generally insufficient.

Organisations should also be able to demonstrate consent: when it was obtained, which version of the notice applied and which purposes were accepted. Withdrawal is part of consent, not an afterthought. It should be as easy to withdraw as to agree. The organisation should explain what withdrawal can and cannot change, including processing already carried out lawfully and records retained under another obligation.

A withdrawal route that exists only through a distant office is not practically usable.

Consent is one legal basis, not the universal basis for all processing. Organisations sometimes request consent where a contract, legal obligation or legitimate interest is the actual basis, then proceed regardless of the answer. That turns the choice into theatre. The correct legal basis should match the relationship and purpose. Legal consent also does not resolve every ethical issue.

A person may validly agree to a data use that creates collective effects for a community, or to terms shaped by economic necessity. Conversely, some processing may be lawful without consent and still require fairness, transparency and safeguards. Compliance is not the full account of responsible data practice. Consent should not be confused with Free, Prior and Informed Consent.

FPIC is a collective right of Indigenous Peoples in specified contexts and concerns decisions affecting lands, resources and rights. A personal-data consent form cannot substitute for the collective process. The discipline is to preserve choice throughout the system. Ask whether refusal is genuinely possible, whether purposes are separated, whether information is understood and whether withdrawal works in practice.

The form is only the record; valid consent is the quality of the decision around it.

Practical application

Use consent only where it is the appropriate legal basis. Separate purposes and avoid conditioning a service on unnecessary processing. Provide concise, layered information in relevant languages and formats, and record the notice version and choices made. Design refusal and withdrawal before launch. Train enumerators not to pressure participants and monitor refusal patterns for hidden coercion.

Re-consent where purposes materially change rather than treating the original signature as permanent permission.

Why it matters

Consent protects autonomy when people can make a real and informed choice. Weak consent practices transfer control to organisations while preserving the appearance of permission, creating legal risk and loss of trust.

Common misconception

Consent is often treated as a signed form that authorises any reasonable future use. Valid consent is purpose-specific, informed, freely given and withdrawable. A signature cannot repair coercion, ambiguity or function creep.

Connections

Data Minimisation limits what may be collected even with consent. Legitimate Interest provides a different legal basis and requires balancing. Privacy by Design makes choices usable, while FPIC addresses distinct collective rights.

A question worth asking

If the person said no, would they still receive the product, service, payment or market access they reasonably expected - and do they know that before deciding?

Selected references

European Union. 2016. Regulation (EU) 2016/679, Articles 4(11), 7 and 8. European Data Protection Board. 2020. Guidelines 05/2020 on Consent under Regulation 2016/679. European Data Protection Board. 2024. Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models. OECD. 2013. Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data. United Nations. 2007.

United Nations Declaration on the Rights of Indigenous Peoples.