Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

What to Consider When It Comes to the GDPR and Consent

According to the General Data Protection Regulation (GDPR), an entity must have a "valid lawful basis" to process personal data. If you can process data without handling any personal information of the user, then continue that way. If not, the law defines six lawful reasons for processing personal data:

  1. Consent
  2. Contract
  3. Legal Obligation
  4. Vital Interest
  5. Public Task Interest
  6. Legitimate Interests

No one basis is more important than the other or should be viewed as the path of least resistance. The basis you should operate under will come down to your purpose for processing personal data and the ongoing relationship you plan to have with the data subject.

However, one of the six is more complex to implement than the others, but it is also likely to engender the most trust: consent. Gaining consent should put the power in the hands of an individual so that they have a real and genuine choice about how their personal data is used and processed. That is backed by the GDPR requiring "positive opt-ins," so no methods of default consent are allowed.

This approach presents advantages. Giving the individual control to make their own choice engenders trust and can enhance an organization's reputation because there is nothing hide, so to speak. In a world with long privacy notices and abundant product notifications, your clients may find an open and honest approach to consent to be refreshing.

A checklist to help you take the right approach when it comes to consent should include the following actions. 

Try to ensure:

  • The request for consent is separate and conspicuous. (Note: As a controller, you should seek consent prior to any personal data collection, and as a processor, you should seek consent prior to any personal data processing. So, know and understand which role you are operating as for each process, either a controller or a processor.)
  • Consent is the most appropriate lawful basis for processing someone's personal data.
  • You ask people to positively opt in and that you are not using any methods of default consent.
  • Any associated language you use while asking for consent is clear and easy to understand, including informing individuals that they can withdraw their consent.
  • Clients can just as easily withdraw their consent at any time as they can provide it.
  • You clearly explain why you want someone's data and what you plan to do with it.
  • Individuals can refuse to consent without impact or detriment and that there are no preconditions around consent being required as part of a service.
  • You provide options to consent separately for different types of processing.

As you can see, there is a lot to consider, including what to do if you offer online services to children or how will you record consent, so careful planning is a must. Individuals also have certain rights under the GDPR which you should consider when following the consent path as a lawful basis, including the right to restrict processing, erasure and the right to be informed.

Obviously before you can do any of this, you need to know where your data flows and what is subject to the GDPR. Trustwave can help with a range of offerings, including workshops, risk assessments, privacy assessments and more.

Brian Odian is managing consultant of global compliance and risk services. 

Latest Trustwave Blogs

How Cybercriminals Use Breaking News for Phishing Attacks

Trustwave SpiderLabs issued a warning that threat actors may attempt to take advantage of CrowdStrike’s software update that caused widespread outages by using the news as the center of a social...

Read More

Trustwave Response: CrowdStrike Falcon Outage Update

Trustwave is proactively assessing and monitoring our clients who may have been impacted by CrowdStrike’s recently rolled-out update for its Windows users. The critical issue identified with...

Read More

Accelerating Value for Microsoft Defender XDR, Copilot for Security, and Sentinel

The unparalleled capabilities encapsulated within Microsoft Defender XDR, Copilot for Security, and Sentinel can be powerful when an organization knows how to expertly tap into these resources. The...

Read More