Do I need an active consent according to GDPR?
<p>If I have a form on a website where people fill in their personal details and credit card information to subscribe to a monthly delivery of apples, do I need an active consent (e.g. checkbox) from the user in order to store his or hers data?</p>

<p>The personal data will <em>only</em> be used to deliver apples and nothing else. Do I still need an active consent from the user? It would seem to me that the user already understands that the personal information is used to deliver apples, and an extra checkbox would seem superfluous?</p>

<p>Or would I only need an extra consent if the data is used for something non-obvious?</p>

<p><strong>Short answer:</strong></p>

<p>In your case (delivering apples), no.</p>

<p><strong>Long answer:</strong></p>

<p>You asked:</p>

<blockquote>
  <p>do I need an active consent (e.g. checkbox) from the user in order to store his or hers data?</p>
</blockquote>

<p>No, for "common" personal data (name, e-mail, address, credit card info), you don't. Article 4(11) states:</p>

<blockquote>
  <p>‘consent’ of the data subject means any freely given, specific, informed and unambiguous <strong>indication</strong> of the data subject's wishes by which he or she, by a statement or by a <strong>clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her;</p>
</blockquote>

<p>Filling in personal details and credit card information is a clear affirmative action and an indication of will.</p>

<p>Your next question:</p>

<blockquote>
  <p>Or would I only need an extra consent if the data is used for something non-obvious?</p>
</blockquote>

<p>Explicit consent is required only when you're processing data about race, religion, sex life, sexual preferences and other sensitive data as listed in Article 9 of GDPR:</p>

<blockquote>
  <ol>
  <li>Processing of personal data revealing <strong>racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data</strong> for the purpose of uniquely identifying a natural person, <strong>data concerning health or data concerning a natural person's sex life or sexual orientation</strong> shall be prohibited.</li>
  <li>Paragraph 1 shall not apply if one of the following applies: (...) the data subject has given <strong>explicit consent</strong> to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;</li>
  </ol>
</blockquote>

gdpr