§ GDPR · Article 7
GDPR Article 7: Obligations, Deadlines & Penalties
At a glance
Article 7 of the GDPR imposes 5 obligations on controller. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 7
Obligation 1
The controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
Regulation (EU) 2016/679, Article 7, Article 7
- Obligated entity
-
controller
- Action required
-
demonstrate
- Deadline
-
—
- Penalty
-
—
Obligation 2
If consent is given in the context of a written declaration concerning other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
Regulation (EU) 2016/679, Article 7, Article 7
- Obligated entity
-
controller
- Action required
-
present
- Deadline
-
—
- Penalty
-
—
Obligation 3
Prior to giving consent, the data subject shall be informed of the right to withdraw consent at any time.
Regulation (EU) 2016/679, Article 7, Article 7
- Obligated entity
-
controller
- Action required
-
inform
- Deadline
-
prior to giving consent
- Penalty
-
—
Obligation 4
It shall be as easy to withdraw consent as to give consent.
Regulation (EU) 2016/679, Article 7, Article 7
- Obligated entity
-
controller
- Action required
-
ensure
- Deadline
-
—
- Penalty
-
—
Obligation 5
When assessing whether consent is freely given, utmost account shall be taken of whether the performance of a contract is conditional on consent to processing not necessary for that contract.
Regulation (EU) 2016/679, Article 7, Article 7
- Obligated entity
-
controller
- Action required
-
assess
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 7
Who must comply with Article 7 of the GDPR?
+
controller.
What does Article 7 of the GDPR require?
+
demonstrate present inform
What is the compliance deadline for GDPR Article 7?
+
prior to giving consent