GDPR and online forms: how to prove that the data owner opted in?
<p>How can the data processor who collect personal information using an online form prove that the person who entered her data gave active consent, for instance by clicking a checkmark?</p>

<p>Imagine a a registration form, where the user enter her information, and those are sent to and stored in a database.
The data processor can see that the bit of data corresponding to the opt-in is there (e.g. the value in column <code>consent</code> in the table <code>submissions</code> is <code>TRUE</code> for the given entry). But how to tell if that is there because the user actually performed some kind of actions or not?</p>

<p>Using only the information in the database, that is technically not provable. Or am I missing something?</p>

<p>You are missing something.</p>

<p>The fact that you have a tick box and its state is saved in the database is enough. The burden of proof is only "on a balance of probabilities", so someone arguing that they didn't consent would have to demonstrate that you falsified the database entry somehow.</p>

<p>In terms of GDPR requirements in general you don't need a greater level of proof than this, the key thing is that you have a robust system in place to obtain proof (such as not allowing data into the database without a tick in the box).</p>

gdpr online