Is oral consent enough?
In short
Oral consent is as valid as written consent, but it is the person processing the data who has to prove that consent was given. A conversation leaves nothing to point at.
Oral consent is valid. That is not where the problem lies.
The problem is that you are the one who has to prove consent was given, and what was agreed to. A conversation will not do that, and it is precisely that proof which gets asked for when somebody complains or enquires a year later.
What consent has to cover
Consent is an agreement, and the other party has to know what they are agreeing to.
Who is responsible. A name and an organisation, so it is clear who the agreement is with.
What the data will be used for. Where there are several purposes, each needs its own consent. A yes to keeping records is not a yes to the newsletter.
Which data it concerns. Listed out, not as “contact details and the like”.
Who it may be shared with. Said plainly, and with the agreements in place at the receiving end.
How long it is kept, and what happens when that time is up.
That consent can be withdrawn as easily as it was given.
The question that should come first
Is consent the right basis at all?
Consent assumes a genuinely free choice. That rarely exists between an employer and an employee, and it rarely exists where one party depends on the other. Consent given because saying no would be awkward is not freely given.
Where another basis applies, usually a contract or an obligation that follows from legislation, that is normally the right one, and the consent becomes a problem you have taken on for no reason.
In practice
Write it down. Not because the law demands a document, but because you have to be able to show it.
Written consent rarely leaves room for doubt, it is good evidence, and it makes it easier to check whether it still holds. That last point is the one people forget. Consent given in 2019 for a purpose that has since changed is not consent to what is happening now.
Questions we get
- Is oral consent invalid?
- No. Oral consent is valid. The problem is not validity, it is the burden of proof. That sits with whoever is processing the data, and a conversation leaves nothing behind.
- What does consent have to cover?
- Who is responsible for the processing, what the data will be used for, which data it concerns, who it may be shared with, how long it is kept, and that consent can be withdrawn as easily as it was given. Where there are several purposes, each one needs its own consent.
- Can consent be withdrawn?
- Yes, and it has to be as easy to withdraw as it was to give. If somebody can say yes in a conversation, they must be able to say no in one. That is another reason oral consent is awkward in practice, because there is no record of the withdrawal either.
- Is consent the right basis at all?
- Often it is not. Consent requires a genuinely free choice, and that rarely exists between an employer and an employee, or in any relationship where one party depends on the other. Where another basis applies, such as a contract or a legal obligation, that is usually the right one.
Sources
- Timbed's own article on oral consent, written for Persondata for Behandlere, 1 January 2020
- Guidance of the Danish Data Protection Authority on consent, 16 December 2021
Last updated 24 September 2026