Legislation – Data (Use and Access) Act 2025

“(1A)

“Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).”

“(aa)

section 40A makes provision about processing carried out in reliance on the consent of the data subject,”.

“40AConditions for consent

(1)

This section is about processing of personal data that is carried out in reliance on the consent of the data subject.

(2)

The controller must be able to demonstrate that the data subject consented to the processing.

(3)

If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—

(a)

in a manner which clearly distinguishes the request from the other matters,

(b)

in an intelligible and easily accessible form, and

(c)

in clear and plain language.

(4)

Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.

(5)

The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).

(6)

Processing may only be carried out in reliance on consent if—

(a)

before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and

(b)

it is as easy for the data subject to withdraw the consent as to give it.

(7)

When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.”