(42) If the processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has consented to the processing operation. In particular, in the case of a written statement made in another matter, there should be guarantees that the data subject is aware of the consent and its scope. According to Council Directive 93/13/ EEC*, the statement of consent prepared by the controller should be in an intelligible and easily accessible form, be written in clear and simple language, and should not contain unfair conditions. In order for consent to be informed, the data subject should know at least the identity of the controller and the intended purposes of the processing of personal data. Consent should not be considered voluntary if the data subject has no real or free choice and cannot refuse or withdraw consent without adverse consequences.
„Our HR employee has taken on the responsibilities of the DPO, has attended training, and will manage it."
Are you sure about that?

