Framework
Consent Management Framework
This framework defines the operating model for capturing, recording, refreshing, and honouring consent across the organization. It distinguishes consent from other lawful bases, sets the validity standard, identifies the granularity required for different purposes, and defines the audit trail that supports a defensible position with supervisory authorities and data subjects.
- Type
- Framework
- Version
- 1.0.17
- Date
- 2026-10-16
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material regulatory, jurisdictional, or product change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- When consent is the lawful basis
- Validity standard
- Granularity rules
- Consent record
- Withdrawal
- Refresh and expiry
- Children's data
- Cookie and similar technologies consent
- Operating expectations
- Metrics
- Framework alignment
- Limitations
Frameworks it maps to
- GDPR
- UK GDPR
- UK PECR (S.I. 2003/2426) regulation 6, as amended by the Data (Use and Access) Act 2025 s. 112 and Schedule 12
- EDPB Guidelines 05/2020 (v1.1)
- ePrivacy Directive 2002/58/EC and national transpositions
- LGPD
- PIPL
- COPPA
- Canada PIPEDA (OPC Fair Information Principles)
- CPPA (lapsed, not in force)
- CCPA / CPRA
- ISO/IEC 29184:2020
Related documents
- Privacy and Data Governance Policyprivacy
- Privacy Notice Templateprivacy
- Cookie and Tracker Registerprivacy
- Record of Processing Activities Templateprivacy
- Data Subject Rights Management Procedureprivacy
- Children's Data Frameworkprivacy
- Privacy Jurisdiction Indexprivacy
Next
All Documents