1CO2.03.47
47
Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered. Data recipients are not required to allow the consumer to choose an alternative duration where a duration of 12 months or less is proposed. However, data recipients may voluntarily provide this choice. When presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle. As business consumer statements cannot be given in relation to collection consents, they have a maximum duration of 12 months. Data recipients wishing to offer durations greater than 12 months for business consumer disclosure consents will need to present 2 different durations for the 2 consent types.
CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen)
Consent: Amending consents
4 August 2025