Toestemmingslog

Toestemmingslog is a record-keeping tool used by organizations to document consent from individuals for the processing of personal data. Such logs are commonly maintained to demonstrate compliance with data protection legislation, including the European Union's General Data Protection Regulation (GDPR) and its Dutch implementation (AVG). The log records when consent was obtained, what it covers, and that the user was informed of the purposes, data categories, and retention terms. It also notes how the consent was obtained (for example via a banner, checkbox, or consent notice), the version of the privacy notice, and the status of consent (given or withdrawn).

Typical content includes: user identifier (often pseudonymized), timestamp, purposes for processing, data categories, method of consent, policy version, language/locale, device context, and any withdrawal or modification events. The log supports accountability, enabling organizations to show that processing is based on consent that is freely given, specific, informed, and unambiguous. It is commonly integrated with a consent management platform (CMP) and privacy notices, and it should be protected with appropriate security measures and access controls. Retention should align with legal obligations and data minimization, and procedures should exist to honor data subject requests to access, correct, or delete consent records.

Legal and governance considerations include that consent logs must be accurate, auditable, and up to date, especially when consent is used as the lawful basis for processing. They are often part of broader privacy governance, including DPIAs and data processing agreements with processors. The term is most common in Dutch-language contexts, but similar concepts exist globally under consent logs, consent histories, or consent registers.