How do we ask for consent to process data correctly, and prove we got it?

You do not need consent if the data is necessary to perform a contract or is required by law. For example, an online shop does not need consent for the delivery address – without it, it cannot deliver the goods.

Worse: asking for consent where you do not need it creates a problem. The person can withdraw consent at any time (Article 7(3) GDPR), and then you have to explain why you keep processing.

Consent is usually the right basis for:

• a newsletter to people who are not your customers (electronic communications rules also require consent here);
• photos or videos for marketing;
• recording a call or consultation when recording is not necessary for the service;
• cookies that are not needed for the website to work (electronic communications rules require the consent; the GDPR sets its quality);
• special-category data, such as health data, where no other exception in Article 9(2) applies. This needs explicit consent, and it cannot be used where the law forbids it (Article 9(2)(a) GDPR).

At work, consent almost never fits, because an employee depends on the employer and their consent is rarely free (Article 7(4) GDPR and recital 43, which speaks of a clear imbalance between the parties).

Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes. Each condition becomes a practical rule:

If you ask for consent in a document that also covers other matters, such as an order form, Article 7(2) GDPR requires the request to be clearly distinguishable from the other parts and written in plain language.

Sample wording

☐ I agree that [company name] may send me its newsletter about its services by email. I can withdraw my consent at any time by clicking "Unsubscribe" in any email or by writing to [email address]. Withdrawal does not affect processing carried out before it.

The last two sentences are not decoration. Article 7(3) GDPR requires the person to be told about the right to withdraw before giving consent.

Article 7(1) GDPR: the controller must be able to demonstrate that the person consented. "They agreed themselves", with no record, proves nothing.

Keep:

1. Who consented – a name or email address by which you can identify the person.
2. When – date and time.
3. To which wording – the exact text the person saw. If you change it later, keep the old version too.
4. How – a website form, a signed paper form, a confirmation email.
5. For which purpose – if there were several boxes, which ones were ticked.

On a website this is usually done by the form or newsletter system – check that it stores the version of the wording, not only the date. For paper consent, the sheet and a note of where it is kept are enough.

Article 7(3) GDPR: it must be as easy to withdraw as to give consent. If consent took one click, you cannot demand a signed letter to withdraw it.

When you receive a withdrawal:

• stop processing the data for that purpose;
• record the withdrawal date on the same entry;
• check whether the data remains in other systems, such as the mailing platform.

Withdrawal does not undo what was lawfully done before it.

In your record of processing activities, state the basis for the process – Article 6(1)(a) GDPR – and where the proof of consent is kept. Article 30(1) does not directly require the legal basis in the record, but it is good practice: it makes compliance easier to prove. In the information you give people (the privacy notice), Article 13(2)(c) GDPR requires you to mention the right to withdraw consent.

First review your forms: where do you ask for consent although you have another basis, and where is the box pre-ticked? With the tool (in Lithuanian) you can check free of charge whether you must keep a record of processing activities – the record states the legal basis for each process.

Is verbal consent valid?
The GDPR does not prescribe a form, but the burden of proof is yours. Verbal consent is almost impossible to prove without a recording.

Can one consent cover several purposes?
Not if the purposes differ. Consent must be specific, so each purpose needs its own choice.

Do old consents need renewing?
If old consents do not meet today's conditions, or you have no proof of them, relying on them is risky. You then need either new consent or another basis.

From what age can a child consent on their own?
The age of 14 applies only when an online (information society) service is offered directly to a child: then, in Lithuania, a child can consent on their own from 14 (Article 6 of the Law on the Legal Protection of Personal Data). For a younger child, consent is given or authorised by the holder of parental responsibility (Article 8(1) GDPR), and the controller must make reasonable efforts to verify this (Article 8(2)). The age does not apply to other situations, such as a child's photo at a sports club.

• May we send a newsletter to existing customers? (in Lithuanian)
• Is a website privacy policy mandatory? (in Lithuanian)
• Employee photos on the website and social media

The law and the risk: Why an employee's consent to data processing is almost never valid – dat.lt

• Definition of consent – Article 4(11) GDPR.
• Consent as a legal basis – Article 6(1)(a) GDPR; explicit consent for special-category data – Article 9(2)(a).
• Imbalance between the parties – recital 43 GDPR.
• Proof of consent – Article 7(1) GDPR; separate request – Article 7(2); withdrawal – Article 7(3); freely given – Article 7(4).
• A child's consent to information society services – Article 8(1) and 8(2) GDPR; in Lithuania, 14 years – Article 6 of the Law on the Legal Protection of Personal Data (ADTAĮ).
• Pre-ticked boxes are not consent – recital 32 GDPR.
• Informing about the right to withdraw – Article 13(2)(c) GDPR.

GDPR read from the official texts (OJ L 119, 2016-05-04). ADTAĮ – Register of Legal Acts, consolidated version from 2026-06-30; English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.