311 – Demonstrate user consent

Summary

The system must set a mechanism which can be used to demonstrate that users have granted their consent to collection of their data.

Description

Systems usually request information from their users or collect it based on their interactions with the application. Regulations demand that none of these collections occur without the users consent and that this consent be demonstrable afterwards. Therefore, the system must have a mechanism that can be used to demonstrate the grant of the consent.

Supported In

Advanced: True

References

• GDPR-7_1. Conditions for consent (1)
• SOC2-P6_2. Additional criteria for privacy (related to disclosure and notification)
• CCPA-1798_100. General duties of businesses that collect personal information
• HITRUST-13_a. Privacy notice
• LGPD-8-2. Requirements for the Processing of Personal Data
• OWASPMASVS-PRIVACY-1. The app minimizes access to sensitive data and resources

Weaknesses

• 088 – Privacy violation

Last updated

2024/01/18