You may wish to include the following consent-related controls in your Control Library:
Choice and Consent - Default Control Language: The privacy notice describes the choices available to the data subject. Explicit consent is collected prior to an individual completing their registration, when providing sensitive information, and when personal information is to be used for a purpose not previously specified. The date and time that consent was collected are retained in the user's record. The privacy notice describes the impact of not providing personal information or withdrawing consent.
Marketing Consent - Default Control Language: The organization obtains data subject consent to use PII processed under a contract for the purposes of marketing and advertising. Providing consent is not a condition for receiving the service.
New Purpose Consent - Default Control Language: The entity provides notice to data subjects before personal information is collected and used for new purposes not previously identified.
Consent: Child - Default Control Language: The organization obtains parental consent for processing the personal data of individuals under the age of 16. The organization has procedures in place to ensure that the individual providing consent has parental responsibility.
If you choose to include any of the above controls, the control language should be customized to reflect the specific process that your organization has defined. It's important that your stated control description accurately reflects how your organization implements this control.
Which framework are these for?
SOC 2 - Privacy, GDPR, CCPA, and ISO 27701:2019
Why are these controls important?
Various data privacy laws mandate the concept of consent. This refers to an indication, by a data subject, that they specifically approve of the use, collection, or processing of their personal data. Consent is usually given via the click of a button or checking of a box. If so, the date on which the user gave consent should be collected. In some instances, consent is contractual and does not need to be collected via technological means, such as when using on-line banking to complete transactions. However, this should still be described in the public facing privacy policy.
Who’s involved with these controls?
Typical control owner: Data Privacy Officer
Typical parties involved: Marketing, database admins, website admins, IT managers
How often should I perform these controls?
Choice and Consent - Continuous
Others - As Needed
How do I demonstrate these controls?
Specifically describe choice and consent and new purpose consent in the privacy notice or policy that is on your external facing website.
Documentation showing the consent process, such as a wireframe or a collection of screenshots showing the process.
Maintain a database that indicates the date and time that each user provided their consent.
Documentation showing that consent was re-collected when users were informed that their data is to be used for a new purpose (this may be rare).