1CO.04.24
24
Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered. Data recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice. When presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.
CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen)
Consent: Collection and use consents
1 May 2024
5 March 2025