ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXThe EU's data protection law, explained in plain English, including what it means for your website's cookies and consent.
GDPR stands for General Data Protection Regulation.
Its official name is Regulation (EU) 2016/679. It was adopted by the European Union in 2016 and became applicable on 25 May 2018.
The regulation replaced the EU Data Protection Directive 95/46/EC and created a more consistent data-protection framework across the European Economic Area.
The GDPR is designed to protect individuals' fundamental rights in relation to their personal data while establishing consistent obligations for organisations that process that data.
The GDPR can apply to organisations inside and outside the European Union.
It generally applies when:
This means a company does not necessarily need an office in Europe for the GDPR to become relevant. A business based elsewhere may still fall within its scope depending on what it offers and how it interacts with individuals in the EU.
The GDPR defines personal data broadly.
Personal data is information relating to an identified or identifiable natural person.
Depending on the circumstances, this can include:
Some categories of personal data receive additional protection under the GDPR, including certain health, biometric, genetic, racial or ethnic, religious and other sensitive information.
Processing is also defined broadly under the GDPR.
It can include operations such as:
As a result, GDPR compliance is not limited to data collection. It can apply throughout the lifecycle of personal data.
A data controller is the organisation or person that determines the purposes and means of processing personal data.
The controller is responsible for ensuring that processing complies with applicable GDPR requirements.
For example, a company operating an ecommerce website may determine:
That company may therefore act as a controller for those processing activities.
A data processor processes personal data on behalf of a controller.
Examples can include certain:
The controller remains responsible for selecting appropriate processors and meeting its GDPR obligations, while processors also have obligations under the regulation.
The controller-processor relationship should be clearly documented and governed by the appropriate contractual arrangements.
The GDPR establishes several core principles for processing personal data.
These include:
Organisations must process personal data lawfully, fairly and transparently.
Personal data should be collected for specified, explicit and legitimate purposes and not subsequently processed in an incompatible manner.
Organisations should process only personal data that is adequate, relevant and limited to what is necessary for the purpose.
Personal data should be accurate and kept up to date where necessary.
Personal data should not be retained for longer than necessary for its purpose.
Organisations must use appropriate security measures to protect personal data.
Organisations must be responsible for complying with the GDPR and be able to demonstrate that compliance.
These principles influence everything from privacy notices and data retention to consent management and security controls.
For a website, this means a visitor's cookie choice must change what the site actually does. A banner that says 'Reject all' while analytics and advertising scripts still load does not meet this standard. Real privacy by design blocks non-essential trackers until consent is given, honours withdrawals and keeps a record of each choice.
The GDPR does not require consent for every type of personal-data processing.
Article 6 identifies several lawful bases for processing personal data, including:
Consent is therefore one lawful basis among several.
An organisation should determine the appropriate legal basis for each processing activity rather than automatically treating every processing operation as consent-based.
Where consent is used as the legal basis for processing, GDPR consent must meet specific requirements.
Consent must be:
It must also involve a clear affirmative action.
Silence, inactivity and pre-ticked boxes do not constitute valid GDPR consent.
A consent request should also be clearly distinguishable from other information, use understandable language and explain what the person is agreeing to.
Organisations relying on consent must be able to demonstrate that the individual consented.
This makes consent records an important part of GDPR compliance.
A useful consent record can capture information such as:
The exact information an organisation should retain depends on its processing activities and compliance requirements.
The important principle is that an organisation should not have to rely solely on a user's memory or an unverifiable database flag to prove consent. Article 7 specifically requires the controller to be able to demonstrate consent where processing is based on it.
Yes.
Individuals have the right to withdraw consent at any time when processing is based on consent.
The GDPR also requires that withdrawing consent be as easy as giving it. Withdrawal does not retroactively make earlier consent-based processing unlawful, but the organisation must stop relying on consent for future processing where no other lawful basis applies.
For websites, this is why a consent system should provide an accessible way to revisit and change privacy preferences.
GDPR cookie consent refers to obtaining valid consent where cookies or similar technologies involve processing for which consent is required.
Common examples include:
Cookies are also covered by the ePrivacy Directive (Article 5(3)), which requires consent before non-essential information is stored on, or read from, a visitor's device. The GDPR then sets the standard that this consent must meet. The European Data Protection Board's guidelines on consent explain what valid consent looks like in practice.
A cookie banner by itself does not automatically make a website GDPR compliant.
A compliant consent implementation should ensure that the appropriate technologies do not perform the relevant processing before the necessary consent has been obtained.
This is where prior consent and prior blocking become important.
Prior blocking means preventing non-essential cookies, scripts and trackers from executing until the visitor has made the required consent choice.
This is different from simply displaying a consent banner.
For example, if an analytics or advertising script loads before the user has made a choice, showing a banner afterward does not undo what has already happened.
A technically enforced consent system should therefore connect the user's decision to the technologies that perform the processing.
ConsentX describes this approach as prior-script blocking, where non-essential trackers remain blocked until the appropriate choice is made.
The GDPR provides individuals with a range of rights concerning their personal data.
Depending on the circumstances, these include:
These rights are an important part of GDPR compliance and require organisations to have processes for receiving, authenticating, evaluating and responding to data-subject requests.
GDPR compliance means implementing the organisational, legal and technical measures necessary to meet applicable GDPR requirements.
A GDPR compliance programme may include:
Compliance is therefore broader than installing a cookie banner.
For websites, GDPR compliance often involves several connected systems.
A website may need to:
This is why automated scanning and continuous monitoring can be useful alongside a consent-management platform.
ConsentX provides a scanner designed to identify cookies, trackers, scripts and third-party technologies that load on a website before visitors provide consent.
A practical GDPR website checklist includes:
The GDPR provides for significant administrative fines for certain infringements.
Depending on the type of violation, fines can reach:
Up to €10 million or 2% of worldwide annual turnover, whichever is higher, for certain infringements.
Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for more serious infringements.
The applicable maximum depends on the specific GDPR provision involved.
Penalties are only one part of the enforcement framework. Organisations should therefore focus on building sustainable compliance controls rather than treating the maximum fine as the definition of GDPR compliance.
GDPR consent has to be enforced, not just displayed. ConsentX blocks non-essential trackers until a visitor chooses, honours withdrawals and stores tamper-evident consent records you can show to a regulator. Scan your site free to see what loads before consent, or book a demo to see it working.
The General Data Protection Regulation (GDPR) is one of the world's most influential data-protection laws.
The most important points are:
GDPR compliance is not just about showing users a privacy notice or cookie banner. The technical implementation needs to respect the user's choice, prevent relevant processing before consent, support withdrawal and maintain reliable evidence of what happened. ConsentX helps organisations collect, enforce and prove consent across their websites. Start building audit-ready consent management with ConsentX.
Related Terms
To check your own site, run the free GDPR compliance scanner.
Permission for non-essential cookies and trackers where consent is required.
The technical practice of preventing relevant non-essential trackers from firing before the user provides consent.
Software that collects, manages, enforces and records user consent.
A structured record showing what a user agreed to, including relevant purposes and consent information.
The organisation that determines the purposes and means of processing personal data under GDPR.
An organisation that processes personal data on behalf of a controller.
The individual to whom personal data relates.
The UK's post-Brexit GDPR framework.
India's Digital Personal Data Protection Act.
Explore ConsentX