1. Securing consent
‘Consent’ as a ground for processing personal data lawfully should be used sparingly. Try and rely on another lawful ground first (click ‘here’ for more information on those grounds). Once you have identified your purpose for processing the personal data and you consider ‘consent’ is the only appropriate ground for processing it lawfully, consider the following guidance
Responsible
Complete
Consent must be freely given, specific, informed and unambiguous 
Ensure your consent includes everything outlined in the template consent found ‘here’
Consider the different methods of securing consent, including , in writing
Send the suggested wording to the individual ensuring it’s prominent and not buried in terms and conditions
Secure the consent with either their signature or other positive opt in
Don’t make performance of the contract conditional on their consent
Log their consent in an appropriate log including the name of the person consenting, when consent was given, the wording of the consent, how consent was given (signature/tick box), whether they have withdrawn consent
Only process the data in accordance with the consent
If you need to add another purpose for processing the data ask for further consent
If they withdraw consent allow them to do so as soon as possible unless you have another lawful basis for processing their personal data (in which case inform them of that fact). Ensure that the appropriate processes are put in place to avoid processing their personal data in respect of the withdrawn consent
Consider giving individuals the option of varying their consent using preferences or privacy dashboards
Consider sending out reminders about the fact that individuals can withdraw their consent
Review your consents regularly to ensure that the consents you have secured are still appropriate