Key takeaways

• The UK data protection authority, the Information Commissioner’s Office, issued detailed draft guidance (the “Guidance”) on consent as a basis for processing personal data under the EU General Data Protection Regulation (“GDPR”), which must be complied with from May 25, 2018.
• Under the GDPR, as expanded upon by the Guidance, consent will be more difficult to obtain than is the case under existing data protection legislation.
• The Guidance focuses on when it will be possible to ask for and rely on consent under the GDPR, and when it will not be appropriate.
• The Guidance is subject to a consultation period ending on March 31, 2017.