Control Strategy GDPRArt.8.2.GuardianApproval

URI: CSG-GDPR-Art8-2

Package: GDPR

< prev | next >

Description: Processing of personal data by consent is legal if the subject DataSubject is old enough (16+ or a lower limit in some states). The user interface for role DataSubject should include measures to ensure this. Competence Check represents a check whether DataSubject is old enough to provide consent, Guardian Consent signifies that reasonable efforts must be made to get authorisation from their legal guardian where this proves not to be the case.

Blocked Threats (3)

P.GDPR.Hu-aDoPS-o.8

Extra measures are needed for Service to store Data related to DataSubject who may be a child: the legal basis for this data processing Data relating to DataSubject under the GDPR is consent, but DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.

P.GDPR.Hu-aDPoS-i.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.

P.GDPR.Hu-aDPS-io.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.