Discovering Customer Consent Regulations

Digital privacy focuses on protecting individuals' personal information.

Driven by the EU's General Data Protection Regulation (GDPR).

• GDPR came into effect on May 25, 2018.
• GDPR consists of 99 articles that define the rights of individuals and the obligations of organizations that handle personal data.

GDPR significantly impacts how personal data is used in marketing, sales, and other data-driven activities.

Under GDPR, this data can only be used if an individual explicitly consent to it.

• Consent is defined as a freely given, specific, informed, and unambiguous indication of an individual's agreement to the procession of their personal data.
• Consent must be provided by a clear affirmative action.

The quoted parts of the definition of consent are outlined in Article 4 of the GDPR.

The full text of this definition is: consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

For more information, refer to Article 99 General Data Protection Regulation.

• Processing should be fair and transparent.

• Purpose limitation is vital; data should not be collected without a specified, explicit, and legitimate purpose.

• Accurate and up-to-date data should be captured.

• Data minimization means collecting only the data that is necessary.

• Storage limitations dictate that data should be stored no longer than necessary for its intended purpose.

• Integrity and confidentiality should be maintained on a need-to-know basis.

• Accountability and compliance must be maintained.

The EU General Data Protection Regulation isn't just about protecting sensitive information against hackers and leaks. The GDPR says just as much about data privacy. Here's what businesses need to know about data privacy in the GDPR.

For organizations subject to the GDPR, you need to understand two broad categories of compliance: data protection and data privacy. Data protection means keeping data safe from unauthorized access. Data privacy means empowering your users to decide who can process their data and for what purpose.

The data privacy principles of the GDPR are straightforward. The law asks you to make a reasonable faith effort to give people the means to control how their data is used and who has access to it. To facilitate this, you must transparently and openly provide them with the information they need to understand how their data is collected and used. You have to make it simple for your customers and users to exercise the various rights (such as access and erasure).

For more information, refer to the A guide to GDPR data privacy requirements documentation. 

Consent allows almost anything with data if clearly explained and permission is obtained.

• Consent must be specific and explicit.
• Consent must be given for an exact purpose.
• End users must be able to make informed decisions when providing consent.

• Organizations must provide an easy way to withdraw consent.
• Fully stop data processing for the specified purpose.

• Any change in consent must be carefully audited.
• Indicate the purpose and version of consent granted, renewed, or withdrawn. The information should be retained for a reasonable period and made available upon request.

Consent is just one of the legal bases for processing personal data. Other legal bases include:

• Processing is necessary to satisfy a contract to which the data subject is a party.
• You need to process the data to comply with a legal obligation.
• You need to process the data to save somebody's life.
• Processing is necessary to perform a task in the public interest or to carry out some official function.
• You have a legitimate interest to process someone's personal data. This is the most flexible lawful basis, though the fundamental rights and freedoms of the data subject always override your interests, especially if it's a child's data.

The GDPR further clarifies the conditions for consent in Article 7:

1. Where the processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of his or her personal data.
2. If the data subject's consent is given in the context of a written declaration that also concerns other matters, the request for consent shall be presented in a manner that is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration that constitutes an infringement of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

For more information, refer to the What are the GDPR consent requirements? documentation.

Failing to comply with privacy regulations like GDPR can have severe consequences for organizations. These consequences include hefty fines, reputational damage, and loss of customer trust. GDPR fines can reach up to 4% of annual global turnover or €20 million, whichever is higher.

Beyond financial penalties, non-compliance can lead to negative media coverage, damage to brand reputation, and a decline in customer loyalty. Organizations must prioritize compliance to protect their business and maintain customer trust.

SAP Customer Consent is a solution for managing user privacy, preferences, and consent transparently. It helps organizations uphold rigorous standards to support compliance with international privacy regulations. It provides a secure profile, preference, and consent management solution that addresses regional privacy compliance throughout the customer lifecycle, giving customers control over their data.

With SAP Customer Consent, you can display terms to which users must consent in exchange for using your site's services, capturing the version they agreed to and when. Based on this consent, services can be fine-tuned and data can be shared with third-party applications using Dataflows (IdentitySync), SAP Customer Data Cloud's ETL platform.

The Consent Vault maintains a searchable log of user consent interactions, enabling you to track and manage the history of all consent transactions on your site.

For more information, refer to the Customer Consent documentation in the SAP Help Portal.