The controller. Paragraph 1 provides that where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented, which in practice obliges controllers to keep records of when, how and for what purposes consent was obtained, in line with the accountability principle of Article 5(2).

Consent bundled into a written declaration that also concerns other matters is valid only if the request is presented in a manner clearly distinguishable from those other matters, in an intelligible and easily accessible form, using clear and plain language, as paragraph 2 requires. Any part of such a declaration which infringes the Regulation is not binding on the data subject.

Withdrawal ends the lawfulness of consent-based processing for the future but does not affect the lawfulness of processing carried out before the withdrawal, as paragraph 3 states. The data subject must be informed of the right to withdraw before giving consent, withdrawal must be as easy as giving consent, and where no other basis under Article 6(1) applies the data subject may then obtain erasure under point (b) of Article 17(1).

Paragraph 4 directs that utmost account be taken of whether performance of a contract, including provision of a service, is made conditional on consent to processing that is not necessary for that contract. Recital 43 adds that consent is presumed not to be freely given where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority, or where no separate consent can be given to distinct processing operations.