Data processing consent — a template
Consent is the most used and simultaneously most needlessly used instrument in the GDPR. Before filling in a template, it pays to check whether you need one at all — for a large share of forms the answer is no.
First: do you even need it?
The GDPR lists six legal bases and consent is only one. For an order, a paid event sign-up or a return, the basis is performance of a contract — it cannot be performed without the customer’s details, so consent is unnecessary and asking for it makes no sense. For replying to an enquiry, legitimate interests usually covers it.
You need consent where the processing is not necessary for any of the above. Typically marketing emails, keeping a CV for future openings, or publishing photographs.
The practical consequence: an “I agree to the processing of my data” box as a condition of submitting an order is a mistake. Consent must be freely given, and if you will not fulfil the order without it, it is not free.
What the consent must contain
- Who the controller is — name, company number, contact.
- Which data is processed and for what specific purpose.
- How long it is kept, or how the period is determined.
- Who it is passed on to, if anyone.
- A statement that consent can be withdrawn at any time, and how.
- A link to your privacy policy.
Collecting it with a form
The consent field
A checkbox with your own wording, which can carry a link to your policy. It must not be pre-ticked.
Separate the purposes
Marketing belongs in its own field, not required for submission. One consent covering everything is defective.
Provability
The submission time and IP address are stored with the response, so you can show when consent was given and in what wording.
Withdrawal
Handle withdrawal with a second form or by email; responses can then be deleted individually or in bulk.
This is not legal advice and Gatherino does not provide any. Have both the wording and your choice of legal basis reviewed by a lawyer in sensitive cases — the assessment depends on what you actually do with the data.
FAQ
Do I need consent on every form?
No. Orders and sign-ups usually rely on performance of a contract. Consent is typically for marketing.
Can the box be pre-ticked?
No. A pre-ticked box is not valid consent.
How do I prove consent was given?
The response stores the time and IP address; together with the form wording that is your record.
What if someone withdraws consent?
You must stop the processing based on it and delete or anonymise the data. Responses can be deleted individually or in bulk.
Related
Try Gatherino for free
Free plan: 3 forms and 100 responses a month. No credit card, EU-hosted data.
Get started free →