Skip to main content
Glossary termPublished inNormenkader IBP

Consent

Also known as toestemming, opt-in

What does "consent" mean under the GDPR?

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Defined in / by

Last updated: 14 October 2026.

Four conditions and an act

The definition stacks four qualities, freely given, specific, informed and unambiguous, and then requires an act: a statement or a clear affirmative action. Silence, a pre-ticked box or carrying on with a service does not meet the last part. Kennisnet's begrippenlijst for the Normenkader IBP lists opt-in and opt-out separately for that reason; only an opt-in can be consent.

Consent is one of six lawful bases in Article 6(1), and for a school it is often the wrong one. Most processing in a school follows from education law or from tasks the school must perform, and consent that a pupil or parent cannot refuse without consequence is hard to call freely given. Where a school does rely on consent, for example to publish photographs, Article 7(3) gives the data subject the right to withdraw it at any time, and withdrawing must be as easy as giving it.

Age matters too. Article 8(1) sets 16 as the age from which a child can consent to information society services offered directly to the child, and lets Member States set a lower age of no less than 13. Below that age, consent must be given or authorised by the holder of parental responsibility.

Questions and answers

Is a pre-ticked box valid consent under the GDPR?

No. Article 4, point (11), of the GDPR requires a statement or a clear affirmative action. A box that is ticked in advance involves no action by the data subject, so it cannot signify agreement in the sense of the definition.

Can a data subject withdraw consent under the GDPR?

Yes, at any time. Article 7(3) of the GDPR gives the data subject the right to withdraw consent and requires withdrawal to be as easy as giving consent. Withdrawal does not make the processing carried out before it unlawful.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms