Consent is a control, not a default. PT-4 Consent asks you to implement mechanisms for people to consent to the processing of their personal data before it is collected, in a way that supports informed decisions. NIST 800-53 binds US federal systems and others by contract. For the rest it is a reference, useful when a customer asks how you handle consent.
What it means in practice
The guidance says consent lets people take part in decisions and moves some of the risk from the organization to the individual. Consent may be required by law. When it is not required, you should consider whether people can reasonably be expected to understand the privacy risks they are accepting. Consent is not always the right tool.
The record lists three enhancements:
- PT-4.1 Tailored Consent, which lets people consent to specific uses.
- PT-4.2 Just in time Consent, which asks at the moment of collection.
- PT-4.3 Revocation, which lets people withdraw consent.
Revocation is where many systems fail. Withdrawing consent has to change what happens to the data, not only a flag in a table.
Evidence to collect
- Screenshots or flow descriptions of consent prompts, with version dates.
- Stored consent records: who, when, which wording, which purposes.
- The revocation path and a test record showing data processing stopped.
- Review of the consent text by legal or privacy staff.
Common gaps
- Pre ticked boxes or bundled consent.
- Consent text changes but old records do not show which version was accepted.
- Withdrawal is possible only by emailing support.
- Downstream systems keep processing after withdrawal.
How to implement it
Store consent as an event with a timestamp, purpose and text version. Make withdrawal as easy as consent. Publish an internal flow for propagating a withdrawal to every system that holds the data, and test it quarterly.
Quick check
Is consent always the right basis?
No. The guidance says to consider whether people can understand and accept the risks. In many cases another basis, such as a contract, fits better.
