The rule.
“the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- The burden of proof sits with the controller: for each person, you can show that they consented.
- In practice: who, when, where (the form and its version), what they were told and what they ticked.
Who it applies to.
Controllers relying on consent.
Common violations in marketing copy.
A purchased or migrated list with no source or timestamp
Nothing demonstrates the consent of the people on it.
Consent text edited with no record of which version each subscriber saw
You cannot show what the person agreed to.
Non-compliant vs compliant.
“They're on the list, so they must have signed up.”
“Consent record: email, timestamp, form URL, form version 3, consent text shown, IP — kept for as long as we email them.”
Related rules.
-
GDPR Article 7(2) · European Union
-
GDPR Article 7(3) · European Union
-
GDPR Article 7(4) · European Union
-
GDPR Article 6(1)(a) · European Union
-
NorthPoint’s long-form page.
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 7(1) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/7/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.