In general you cannot rely on consent for processing activities within a professional context. The imbalance of power between the Organisation and the individual means that such consent cannot be considered to be "freely given".

However, for any activity needing to rely on consent, which typically will mean that there is no other justifiable basis for the processing of the personal data, then the following must be observed:

• Consent must be unambiguous and involve a clear affirmative action, explicit consent is preferred at CERN for all cases.
• Specifically, pre-ticked boxes are not to be used, the person must tick the box for it to be a clear affirmative action.
• Granular consent for distinct processing operations and purposes is required.
• You must keep clear records to demonstrate consent.
• There is a specific right to withdraw consent. You need to tell people about their right to withdraw, and offer them easy ways to withdraw consent at any time.