> Acme Inc — GDPR Art. 7 Consent Evidence Records

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Purpose

This document defines the consent record format used by Acme Inc to demonstrate that valid consent was obtained from data subjects, as required by GDPR Article 7(1): "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of his or her personal data."

Every consent event (grant, withdrawal, modification) must be logged using this template and stored for the duration of the processing activity plus the applicable retention period.

## 2. Consent Record Fields

Each consent record must contain the following fields:

Field | Type | Required | Description
--- | --- | --- | ---
`consent_id` | UUID | Yes | Unique identifier for this consent record
`user_id` | String | Yes | Internal user identifier (anonymised where possible)
`timestamp` | ISO 8601 | Yes | Exact date and time consent was recorded (UTC)
`consent_type` | Enum | Yes | Category of consent (see Section 3)
`consent_action` | Enum | Yes | `granted`, `withdrawn`, `modified`, `expired`
`ip_address` | String | Yes | IP address at time of consent (for geo-verification)
`user_agent` | String | Yes | Browser/device user agent string
`method` | Enum | Yes | How consent was collected (see Section 4)
`policy_version` | String | Yes | Version of the privacy/cookie policy shown at consent time
`consent_text` | String | Yes | Exact text/prompt presented to the user
`language` | ISO 639-1 | Yes | Language of the consent prompt
`expiry_date` | ISO 8601 | No | When this consent expires (if applicable)
`parentconsentid` | UUID | No | Links to prior consent record if modified/renewed
`source_url` | URL | No | Page URL where consent was collected
`geo_location` | String | No | Country/region derived from IP (for jurisdiction)

## 3. Consent Types

Define all consent types applicable to your processing activities:

Consent Type | Description | Lawful Basis
--- | --- | ---
`essential` | Essential service functionality | Not consent-based (legitimate interest/contract)
`analytics` | Website/app analytics and usage tracking | Consent (Art. 6(1)(a))
`marketing` | Marketing emails, newsletters, promotions | Consent (Art. 6(1)(a))
`advertising` | Targeted advertising and ad personalisation | Consent (Art. 6(1)(a))
`third_party` | Sharing data with third-party processors | Consent (Art. 6(1)(a))
`ai_processing` | AI/ML model training or automated decision-making | Explicit consent (Art. 9(2)(a) / Art. 22(2)(c))
`payment` | Storing payment details for future transactions | Consent (Art. 6(1)(a))
`communication` | Contact via specific channels (email, SMS, push) | Consent (Art. 6(1)(a))
`profiling` | User profiling for personalised experiences | Consent (Art. 6(1)(a))

## 4. Collection Methods

Method | Description | Evidence Stored
--- | --- | ---
`web_form` | Checkbox or toggle on website/app | Screenshot hash, form version
`cookie_banner` | Cookie consent management platform | CMP record ID, banner version
`email_optin` | Double opt-in email confirmation | Confirmation email ID, click timestamp
`api` | Consent granted via API call | API request log, auth token
`verbal` | Verbal consent (phone/in-person) | Call recording ID, witness name
`written` | Physical or digital signed form | Document ID, signature hash
`sso` | Consent during SSO/OAuth flow | OAuth scope, provider record

## 5. Example Consent Records

### 5.1 Consent Granted

    {
      "consent_id": "550e8400-e29b-41d4-a716-446655440000",
      "user_id": "usr_a1b2c3d4",
      "timestamp": "2026-03-19T14:30:00Z",
      "consent_type": "analytics",
      "consent_action": "granted",
      "ip_address": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
      "method": "cookie_banner",
      "policy_version": "2.1.0",
      "consent_text": "We use analytics cookies to understand how you use our site. You can change your preferences at any time.",
      "language": "en",
      "expiry_date": "2027-03-19T00:00:00Z",
      "source_url": "https://acme-saas.com/signup",
      "geo_location": "DE"
    }

### 5.2 Consent Withdrawn

    {
      "consent_id": "660e8400-e29b-41d4-a716-446655440001",
      "user_id": "usr_a1b2c3d4",
      "timestamp": "2026-03-19T16:45:00Z",
      "consent_type": "analytics",
      "consent_action": "withdrawn",
      "ip_address": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
      "method": "web_form",
      "policy_version": "2.1.0",
      "consent_text": "You have withdrawn your consent for analytics cookies.",
      "language": "en",
      "parent_consent_id": "550e8400-e29b-41d4-a716-446655440000",
      "source_url": "https://acme-saas.com/settings/privacy",
      "geo_location": "DE"
    }

## 6. GDPR Article 7 Compliance Checklist

Ensure each consent record meets these requirements:

- Demonstrable (Art. 7(1)) — You can prove consent was given (timestamp, IP, method, exact text)
- Freely given — Consent is not bundled with T&Cs; separate consent for each purpose
- Specific — Each consent type maps to a specific, named processing purpose
- Informed — The consent text clearly identifies the controller and processing purposes
- Unambiguous — Consent requires a clear affirmative action (no pre-ticked boxes)
- Withdrawable (Art. 7(3)) — Withdrawal is as easy as giving consent
- Recorded — All consent events (grant, modify, withdraw) are immutably logged
- Versioned — The policy version shown at consent time is recorded
- Age-verified — For children, parental consent is obtained per Art. 8

## 7. Storage & Retention

Aspect | Requirement
--- | ---
Storage | Consent records must be stored in an append-only, tamper-evident log
Encryption | Records must be encrypted at rest (AES-256) and in transit (TLS 1.2+)
Access | Read access limited to DPO, legal, and authorised compliance staff
Retention | Retain for the duration of the processing activity + 3 years
Deletion | Consent records may only be deleted after the retention period expires
Backup | Include in regular backup procedures; test restoration annually

## 8. Implementation Guidance

### Database Schema (Example)

    CREATE TABLE consent_records (
      consent_id      UUID PRIMARY KEY DEFAULT gen_random_uuid(),
      user_id         VARCHAR(255) NOT NULL,
      timestamp       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
      consent_type    VARCHAR(50) NOT NULL,
      consent_action  VARCHAR(20) NOT NULL CHECK (consent_action IN ('granted', 'withdrawn', 'modified', 'expired')),
      ip_address      INET NOT NULL,
      user_agent      TEXT NOT NULL,
      method          VARCHAR(30) NOT NULL,
      policy_version  VARCHAR(20) NOT NULL,
      consent_text    TEXT NOT NULL,
      language        VARCHAR(5) NOT NULL DEFAULT 'en',
      expiry_date     TIMESTAMPTZ,
      parent_consent_id UUID REFERENCES consent_records(consent_id),
      source_url      TEXT,
      geo_location    VARCHAR(10),
      created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
    );

    CREATE INDEX idx_consent_user ON consent_records(user_id);
    CREATE INDEX idx_consent_type ON consent_records(consent_type);
    CREATE INDEX idx_consent_timestamp ON consent_records(timestamp);

## 9. Audit & Review

Activity | Frequency | Responsible
--- | --- | ---
Review consent record completeness | Quarterly | dpo@acme-saas.com
Audit consent collection mechanisms | Annually | dpo@acme-saas.com
Test consent withdrawal flow | Quarterly | Engineering
Review consent text for accuracy | After each policy update | Legal
Verify retention and deletion | Annually | Engineering

## 10. Contact

For questions about consent records or this template:

- DPO: dpo@acme-saas.com
- General Contact: legal@acme.com
- Website: https://acme-saas.com

This Consent Record Template was auto-generated by Codepliant based on code analysis. Adapt the consent types and fields to match your specific processing activities. Review with your DPO and legal counsel before implementation.