Logo Advokátní kancelář roku 2023

Consent to the processing of personal data and its withdrawal

The GDRP has indeed been a big topic recently and there have been various confusions. Today, things have calmed down, but many of us still don’t know how it actually works. One of the unclear areas is the withdrawal of consent to the processing of personal data. That’s why we’re bringing you an article that will give you a detailed overview of the procedure and your rights.

8 minutes of reading

Chapters of the article

GDPR and the processing of personal data

TheGDPR, or General Data Protection Regulation, is a regulation that aims to strengthen and unify data protection for all EU citizens and give them greater control over their personal data. The GDPR thus applies to all organisations that process EU citizens’ personal data (e.g. e-shops, government institutions, hospitals, etc.). The key principles of the GDPR include fair and lawful processing, purpose limitation and data minimisation, and retention of personal data.

It applies that you must be informed before processing personal data. So you must receive information about, for example, its purposes, the types of personal data collected, the recipients and the data protection rights of those individuals.

Are you dealing with an issue related to the processing of personal data?

Contact an Affordable Advocate. We will review your case and draft legal services to resolve it within 24 hours. Then, if you decide to put it in our hands, you get the drafting free of charge.

What are your rights under the GDPR

The GDPR gives you a number of rights that serve to control and protect your personal data. Specifically, these include:

1. The right to information about the processing of personal data

This includes the right to be clearly informed about why your data is needed, how long it will be kept and who has access to it. This means that the data processor must provide transparent information, communicate clearly and comply with other conditions relating to the processing of personal data.

2. Right of access

You have the right to ask for a copy of the information an organisation holds about you (in most cases free of charge). This allows you to check what personal data is being processed and whether the processing is lawful.

3. Right to rectification

If information is inaccurate or incomplete, you can ask for it to be updated.

4. Right to erasure (“right to be forgotten”)

This right allows you to request the erasure of your personal data. However, this only applies in certain circumstances, for example when the data is no longer needed or when the processing was based on consent that has been withdrawn.

5. Right to restriction of processing

This allows you to ‘freeze’ the processing of your personal data in certain circumstances (for example, during a data accuracy check or an objection to processing).

6. Right to data portability

This gives you control over your personal data by allowing you to transfer it from one service to another. This right promotes competitiveness and innovation by making it easier to move to a new platform or service, for example.

7. Right to object

In certain cases, you have the right to object to the processing of your data. This applies in particular to situations where your personal data is processed for marketing purposes.

8. The right not to be subject to automated decisions

You have the right not to be subject to decisions based solely on automated processing, including profiling, where these activities have a significant impact on you. This includes situations where such decisions could lead to legal effects or similarly significant impacts.

Tip: I’m sure you’ve come across a popular service that allows you to search for your ancestors using DNA. But you can read what GDPR has to say about it in our article.

Withdrawal of consent to the processing of personal data

Under the GDPR, withdrawing consent to the processing of personal data is possible at any time and must be as simple as giving consent. These are the basic applicable principles:

  • Theability to withdraw consent at any time: the GDPR allows you to withdraw consent to the processing of personal data at any time. There is no time limit for withdrawing consent, so you can do so immediately after giving consent or at any time thereafter.

For the processing of personal data, it should be borne in mind that your consent does not always have to be explicit. In some cases, it is implicit. For example, when you order a service for which you must provide your personal data. In this case, your mere interest in the service is taken as consent to the processing of your personal data.

  • Ease of withdrawal: the processor of your personal data must ensure that the process of withdrawing consent is as easy as giving it. This may involve being able to withdraw consent in the same way that consent was given, withdrawing it via a website, or even via a simple link or button in an email communication.
  • Clarity of information: you should already be informed of the possibility and method of withdrawing consent when you give it. The information should be clear, accessible and not hidden in general or commercial terms and conditions.
  • Immediate cessation: Once consent has been withdrawn, the data processor must immediately stop processing personal data for the purposes for which consent was given, unless there is another legal ground for processing (e.g. record keeping for the purposes of contracts). However, it should be borne in mind that withdrawal of consent does not have retroactive effects. This means that any processing that took place on the basis of consent before its withdrawal remains valid.

How to do this in practice

As we have already mentioned, revocation should be simple with clearly accessible instructions for everyone. In practice, however, this is sometimes not the case. So, if you want to withdraw your consent to the processing of personal data but don’t know how to do it, there is a general method that applies to everyone.

The simplest way is to send an email or letter withdrawing your consent. In it, please include your name, contact details and a description of the consent you wish to withdraw. If you have one, attach a copy of any document or communication in which you originally provided consent.

Once you have sent your request, you should receive an acknowledgementfrom the organisation. The data processor should then accept your request and stop processing your personal data. The timeframe for responding can vary, but the GDPR requires that requests are processed without undue delay. If you do not receive a response, you have the option to lodge a complaint with the Data Protection Authority.

Personal data processing contract

If you are a personal data processor yourself (e.g. you own an e-shop) and are thinking about delegating this duty to someone else, you may have already come across the term processing contract. This governs the relationship between the controller (i.e. the one who determines the purposes and means of processing personal data – you) and the processor (the one who processes personal data on behalf of the controller – the third party). This contract should cover all relevant aspects of the processing of personal data to ensure that it is protected and processed in accordance with the GDPR.

Tip: Many businesses have used templates on the internet to meet their legal obligations under the GDPR and have adapted their documents and terms and conditions accordingly. However, this is not nearly enough to get everything right and not get fined by the Data Protection Authority. Rather, choose the more reliable route of a GDPR audit for businesses. With Affordable Advocate, everything is done simply, online, tailored to what you need, and at a predetermined price. We handle most cases within five working days.

So what should not be missing from the contract?

  • Subject matter and duration of processing: a description of the specific purpose of the processing, including the nature and purpose of the processing and the duration of the processing.
  • Types of personal data and categories of subjects: A detailed description of the types of personal data processed and the categories of subjects (e.g. employees, customers, etc.).
  • Obligations and rights of the controller: A clear definition of the rights and obligations of the controller, including its responsibility for compliance with data protection law.
  • Obligations of the processor: These include the obligation to process personal data only on the instructions of the controller, to ensure the security of the data processed, to maintain confidentiality and to assist the controller in complying with its data protection obligations (e.g. in case of an erasure request)
  • Involvement of an additional processor: Conditions for allowing additional processors and requirement for approval by the controller.
  • Security measures: Description of technical and organisational measures to protect personal data.
  • Transfer of data to third countries: Conditions and safeguards for transfers of data outside the European Union.
  • Audits and inspections: The right of the controller to carry out audits and inspections and the obligation of the processor to cooperate.
  • Penalty: The contract may also provide for a penalty for breach of obligations.
  • Termination of contract: Procedures for erasure or return of personal data after termination of services.

Are you solving a similar problem?

Dostupný advokát team of online lawyers will solve it for you.

Solutions Tailored for You

Our team of experienced attorneys will help you solve any legal issue. Within 24 hours we’ll evaluate your situation and suggest a step-by-step solution, including all costs. The price for this proposal is only CZK 690, and this is refunded to you when you order service from us.

Preset Prices
All services pre-priced for no surprises.
We Do Everything Online
Save time, money and the hassle of travel.
We Work Fast
90 % of issues get solved by the following day.
Experienced Team
We have specialists for every field of law.

Has this content helped you? Give it a rating

No rating yet. Be first to rate and help others.

Author of the article

JUDr. Ondřej Preuss, Ph.D.

Ondřej is the attorney who came up with the idea of providing legal services online. He's been earning his living through legal services for more than 10 years. He especially likes to help clients who may have given up hope in solving their legal issues at work, for example with real estate transfers or copyright licenses.

Education
  • Law, Ph.D, Pf UK in Prague
  • Law, L’université Nancy-II, Nancy
  • Law, Master’s degree (Mgr.), Pf UK in Prague
  • International Territorial Studies (Bc.), FSV UK in Prague

Reviews of the Dostupný advokát service

Recenze služby

Tomáš Hrdlička, Nové Strašecí

before 3 years

I felt very uncomfortable meeting an attorney in person. But Dostupný advokát managed to solve everything for me online. I bought a consultation because my employer had sent me for a long term business trip to an exotic country with no explanation, and I wanted to be sure what my rights in this situation were. (zobrazit více) The Skype consultation was very pleasant and the service was fast. I can fully recommend them.

Recenze služby

Ms Magic, Google reviews

before 3 years

Fast and professional solutions for most normal legal needs at affordable, preset prices. Seriously, what could be better than that? While it sounds ‘too good to be true,’ I’m happy to report that the staff at DA are pros, and what’s more they are honestly dedicated to their awesome mission, which is to make quality (zobrazit více) Fast and professional solutions for most normal legal needs at affordable, preset prices. Seriously, what could be better than that? While it sounds ‘too good to be true,’ I’m happy to report that the staff at DA are pros, and what’s more they are honestly dedicated to their awesome mission, which is to make quality legal services affordable for the average person. I find their prices very fair when compared to what I’ve usually paid for similar services, which means I (and my family and friends) can get the legal help I need without worrying about some black hole of never-ending fees. In my own experience with DA I’ve found everyone there very responsive, and emails and calls are answered in a timely manner. Their large staff also gives me confidence that any legal needs I have can be handled professionally, as there’s always someone with experience in my particular issue. Their head attorney also writes a regular blog and keeps up with all the latest legal trends, which means they as a business stay up-to-date. As someone who’s spent a fortune over the years on legal assistance, or tried to “go it alone” when I couldn’t afford legal help, I wish Dostupny Advokat had been around a long time ago. I highly encourage anyone who needs legal help to TRY THEM FIRST!

Recenze služby

Zuzana Marková, Prague

before 3 years

We had terms and conditions drafted for our gym, and now we are very glad that we did so. Clear relationship rules are the basis for lasting friendships, and never more so than in the business world!

View All Testimonials

You could also be interested in

About us in public media
Logo Česká advokátní komora Logo Advokátní kancelář roku 2023
Follow the news
Facebook Dostupný advokát Twitter / X Dostupný advokát