Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

What to Consider When It Comes to the GDPR and Consent

According to the General Data Protection Regulation (GDPR), an entity must have a "valid lawful basis" to process personal data. If you can process data without handling any personal information of the user, then continue that way. If not, the law defines six lawful reasons for processing personal data:

  1. Consent
  2. Contract
  3. Legal Obligation
  4. Vital Interest
  5. Public Task Interest
  6. Legitimate Interests

No one basis is more important than the other or should be viewed as the path of least resistance. The basis you should operate under will come down to your purpose for processing personal data and the ongoing relationship you plan to have with the data subject.

However, one of the six is more complex to implement than the others, but it is also likely to engender the most trust: consent. Gaining consent should put the power in the hands of an individual so that they have a real and genuine choice about how their personal data is used and processed. That is backed by the GDPR requiring "positive opt-ins," so no methods of default consent are allowed.

This approach presents advantages. Giving the individual control to make their own choice engenders trust and can enhance an organization's reputation because there is nothing hide, so to speak. In a world with long privacy notices and abundant product notifications, your clients may find an open and honest approach to consent to be refreshing.

A checklist to help you take the right approach when it comes to consent should include the following actions. 

Try to ensure:

  • The request for consent is separate and conspicuous. (Note: As a controller, you should seek consent prior to any personal data collection, and as a processor, you should seek consent prior to any personal data processing. So, know and understand which role you are operating as for each process, either a controller or a processor.)
  • Consent is the most appropriate lawful basis for processing someone's personal data.
  • You ask people to positively opt in and that you are not using any methods of default consent.
  • Any associated language you use while asking for consent is clear and easy to understand, including informing individuals that they can withdraw their consent.
  • Clients can just as easily withdraw their consent at any time as they can provide it.
  • You clearly explain why you want someone's data and what you plan to do with it.
  • Individuals can refuse to consent without impact or detriment and that there are no preconditions around consent being required as part of a service.
  • You provide options to consent separately for different types of processing.

As you can see, there is a lot to consider, including what to do if you offer online services to children or how will you record consent, so careful planning is a must. Individuals also have certain rights under the GDPR which you should consider when following the consent path as a lawful basis, including the right to restrict processing, erasure and the right to be informed.

Obviously before you can do any of this, you need to know where your data flows and what is subject to the GDPR. Trustwave can help with a range of offerings, including workshops, risk assessments, privacy assessments and more.

Brian Odian is managing consultant of global compliance and risk services. 

Latest Trustwave Blogs

Phishing: The Grade A Threat to the Education Sector

Phishing is the most common method for an attacker to gain an initial foothold in an educational organization, according to the just released Trustwave SpiderLabs report 2024 Education Threat...

Read More

Unlocking Cyber Resilience: UK’s NCSC Drafts Code of Practice to Elevate Cybersecurity Governance in UK Businesses

In late January, the UK’s National Cyber Security Centre (NCSC) issued the draft of its Code of Practice on Cybersecurity Governance. The document's goal is to raise the profile of cyber issues with...

Read More

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More