Section 69

The 2018 Act is amended as follows. In section 33 (definitions), after subsection (1) insert— “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A). In section 34(2) (overview of Chapter 2 of Part 3), after paragraph (a) (but before the “and” at the end of that paragraph) insert— section 40A makes provision about processing carried out in reliance on the consent of the data subject, After section 40 insert— This section is about processing of personal data that is carried out in reliance on the consent of the data subject. The controller must be able to demonstrate that the data subject consented to the processing. If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made— in a manner which clearly distinguishes the request from the other matters, in an intelligible and easily accessible form, and in clear and plain language. Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding. The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal). Processing may only be carried out in reliance on consent if— before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and it is as easy for the data subject to withdraw the consent as to give it. When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service. In section 206 (index of defined expressions), in the Table, in the entry for “consent”— after “consent” insert “(to processing of personal data)”, for “Part” substitute “Parts 3 and”, and for “section” substitute “sections 33, 40A and”.

← 3 · All articles · 1 →

Source: legislation.gov.uk · retrieved 2026-09-04