Consent cannot be inferred. It cannot be implied. A badly written opt-out buried in terms and conditions is not consent.

The 1995 Data Protection Directive defines consent as:

“Any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”

1. Manage expectations - GDPR ‘compliance’ is a matter of constant review, adoption of policies and adaption of processes. Plan, develop and sustain.

2. Continued awareness and training for staff.

3. Update your privacy policy, consent capture and recording.