Control Strategy GDPRArt.6.1a.ProcessingByConsent

URI: CSG-GDPR-Art6-1-a

Package: GDPR

Description: Processing and/or storage of Data by consent of the data subject DataSubject, by including a means for them to express consent via their interface to the system, maintaining an access control policy for Data based on their consent decisions, and enforcing the policy using an enforcement point in the data access path at Service.

(empty)

P.GDPR.HuDoPS-o.6

Lack of legal basis to store Data related to DataSubject at Service: since data Data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to collect and process their data. In this case the subject controls a process that is using the data, but not the service where it is stored, so consent is still needed to manage the data on their behalf.

P.GDPR.HuDPS-io.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data.

P.GDPR.Hu-aDoPS-o.8

Extra measures are needed for Service to store Data related to DataSubject who may be a child: the legal basis for this data processing Data relating to DataSubject under the GDPR is consent, but DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.

P.GDPR.Hu-aDPS-io.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.

ConsentEnforcement at Role_Service

ConsentInterface at Role_DataSubject

ConsentManagement at Role_Data

Logging at Role_Service

SubjectToGDPR at Role_DataSubject

Control Strategy GDPRArt.6.1a.ProcessingByConsent

Mitigated Threats (0)

Blocked Threats (2)

P.GDPR.HuDoPS-o.6

P.GDPR.HuDPS-io.6

Triggers Threats (2)

P.GDPR.Hu-aDoPS-o.8

P.GDPR.Hu-aDPS-io.8

Control Sets (5)