Building Consent Record-Keeping

Overview

GDPR Article 7(1) states: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of personal data." This obligation to demonstrate consent requires comprehensive record-keeping that captures not only the consent decision but the context in which it was made.

The Kantara Initiative Consent Receipt Specification (v1.1) provides a standardized machine-readable format for consent receipts that satisfies regulatory expectations and enables interoperability.

Required Record Fields

Per EDPB Guidelines 05/2020 (paragraphs 89-107), demonstrating consent requires preserving evidence of:

Core Fields (Mandatory)