1CO2.02.38
38
This flow demonstrates an amendment to a business consumer disclosure consent only. Data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10). Other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months. A detached disclosure consent amendment may occur where the original disclosure consent was given separate to the associated collection and use consents. It may also occur where a bundled collection, use and disclosure consent was given, but different durations were selected for the disclosure consent and the collection consent. If this approach were taken, collection consent renewals would still need to be requested at least every 12 months, inline with the collection duration originally consented to. To avoid detached amendments for consents originally given in a bundled fashion, data recipients may alternatively choose to propose a single duration of up to 12 months for all requested consents when inviting the consumer to give the initial consent. This would allow the data recipient to invite the consumer to renew all the consent types in a single action.
CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)
Consent: Amending consents
5 March 2025