unified
UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure
Where consent or authorization is the basis for collecting, using, retaining, disclosing, selling, or sharing personal data, present the available choices and their consequences clearly and capture freely given, specific, informed consent before the data is collected or disclosed. Maintain auditable consent records, honor withdrawal and opt-out requests (including opt-out of sale/sharing and limits on sensitive-data use) as easily as consent was given, and use compliant authorization forms where required. Document the basis for any implied consent relied upon.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Data Protection & Privacy
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-DATA-02
- title
- Obtain and honor consent for collection, use, and disclosure
- statement
- Where consent or authorization is the basis for collecting, using, retaining, disclosing, selling, or sharing personal data, present the available choices and their consequences clearly and capture freely given, specific, informed consent before the data is collected or disclosed. Maintain auditable consent records, honor withdrawal and opt-out requests (including opt-out of sale/sharing and limits on sensitive-data use) as easily as consent was given, and use compliant authorization forms where required. Document the basis for any implied consent relied upon.
- domain
- Data Protection & Privacy
- control_type
- preventive
- control_category
- administrative
- members
- framework
- nist-800-53
- control_id
- PT-4
- coverage
- full
- relationship
- superset_of
- framework
- soc2
- control_id
- P2.1
- coverage
- full
- relationship
- superset_of
- framework
- soc2
- control_id
- P3.2
- coverage
- full
- relationship
- superset_of
- framework
- soc2
- control_id
- P6.1
- coverage
- full
- relationship
- superset_of
- framework
- gdpr
- control_id
- GDPR-Art7
- coverage
- full
- relationship
- superset_of
- framework
- hipaa
- control_id
- HIPAA-164.508
- coverage
- partial
- delta
- when authorization is mandatory (marketing, sale of PHI, psychotherapy notes) not established
- relationship
- intersects_with
- framework
- ccpa
- control_id
- CCPA-1798.120-121
- coverage
- partial
- delta
- under-16 opt-in consent before selling/sharing minors' data not addressed
- relationship
- intersects_with
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to GDPR-Art7 — Conditions for consent
- framework
- gdpr
- control_id
- GDPR-Art7
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Regulation (EU) 2016/679
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to P6.1 — The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity's objectives related to privacy.
- framework
- soc2
- control_id
- P6.1
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Illegal processing of personal or sensitive data
- strength
- related
- rationale
- Obtaining valid consent supplies the lawful basis where consent is required, reducing unlawful processing.
- SOC 2 Privacy Criteria Assessment tests UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure
- Privacy Program Operations (Consent, Complaints & Sharing) operates UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to PT-4 — Consent
- framework
- nist-800-53
- control_id
- PT-4
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to P2.1 — The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity's objectives related to privacy. The entity's basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented.
- framework
- soc2
- control_id
- P2.1
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to CCPA-1798.120-121 — Right to opt out of sale/sharing and to limit use of sensitive personal information
- framework
- ccpa
- control_id
- CCPA-1798.120-121
- coverage
- partial
- delta
- under-16 opt-in consent before selling/sharing minors' data not addressed
- relationship
- intersects_with
- source_version
- CCPA (2018) as amended by CPRA (2020)
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Power imbalance and loss of self-determination over personal data
- strength
- related
- rationale
- Freely-given consent with withdrawal/opt-out as easy as opt-in partly counters take-it-or-leave-it asymmetry.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Inadequate transparency, notice and deceptive privacy communications
- strength
- primary
- rationale
- Presenting choices/consequences clearly and capturing freely-given, specific, informed consent directly counters misleading dark-pattern consent flows.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- Valid consent capture, records, and honored withdrawals/opt-outs remove the defective-consent-mechanism driver of fines and private actions.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to HIPAA-164.508 — Authorizations required for other uses and disclosures of PHI
- framework
- hipaa
- control_id
- HIPAA-164.508
- coverage
- partial
- delta
- when authorization is mandatory (marketing, sale of PHI, psychotherapy notes) not established
- relationship
- intersects_with
- source_version
- 45 CFR Parts 160/164 (Security, Privacy, Breach Notification)
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Erosion of individual trust and confidence in data practices
- strength
- related
- rationale
- Honoring consent choices and opt-outs meets privacy expectations, sustaining individual trust.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure maps_to P3.2 — For information requiring explicit consent, the entity communicates the need for such consent, as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity's objectives related to privacy.
- framework
- soc2
- control_id
- P3.2
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.