{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-02","description":"Where consent or authorization is the basis for collecting, using, retaining, disclosing, selling, or sharing personal data, present the available choices and their consequences clearly and capture freely given, specific, informed consent before the data is collected or disclosed. Maintain auditable consent records, honor withdrawal and opt-out requests (including opt-out of sale/sharing and limits on sensitive-data use) as easily as consent was given, and use compliant authorization forms where required. Document the basis for any implied consent relied upon.","details":{"control_category":"administrative","control_type":"preventive","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"PT-4","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"P2.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"P3.2","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"P6.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"GDPR-Art7","coverage":"full","framework":"gdpr","relationship":"superset_of"},{"control_id":"HIPAA-164.508","coverage":"partial","delta":"when authorization is mandatory (marketing, sale of PHI, psychotherapy notes) not established","framework":"hipaa","relationship":"intersects_with"},{"control_id":"CCPA-1798.120-121","coverage":"partial","delta":"under-16 opt-in consent before selling/sharing minors' data not addressed","framework":"ccpa","relationship":"intersects_with"}],"statement":"Where consent or authorization is the basis for collecting, using, retaining, disclosing, selling, or sharing personal data, present the available choices and their consequences clearly and capture freely given, specific, informed consent before the data is collected or disclosed. Maintain auditable consent records, honor withdrawal and opt-out requests (including opt-out of sale/sharing and limits on sensitive-data use) as easily as consent was given, and use compliant authorization forms where required. Document the basis for any implied consent relied upon.","title":"Obtain and honor consent for collection, use, and disclosure","unified_id":"UC-DATA-02"},"id":"uc:UC-DATA-02","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-02","sourceIds":["ccpa","gdpr","hipaa","nist-800-53","soc2"],"sourceUrl":null,"title":"UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:147626ba946de1899cd5ca17cf9b036bdbfe4f62009292be05b5143cb0cdec82","properties":{"control_id":"GDPR-Art7","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art7-218fdd35.json","targetId":"ctrl:gdpr:GDPR-Art7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:28b37ecc6aa102ff406c8e16c1ad92f947952c8fec5dfdf0267f083e6f1bcaf5","properties":{"control_id":"P6.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-soc2-p6-1-569a0783.json","targetId":"ctrl:soc2:P6.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:41b7f73e4fe60fabed772b3cde61b49549111b3158d867c81ed21dbe4177d453","properties":{"rationale":"Obtaining valid consent supplies the lawful basis where consent is required, reducing unlawful processing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4355f5ef22b06957363d841765100f11a24c6f18d9dbd1b88932c3df041640ef","properties":{},"sourceDetailPath":"/data/v1/records/wf-d22-f1c724b8.json","sourceId":"wf:D22","targetDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","targetId":"uc:UC-DATA-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:507ea1e75ef25e36b5f7364972159265d7e73ab3b750ce7299bd00a585ba5332","properties":{},"sourceDetailPath":"/data/v1/records/wf-r9-636a9e6e.json","sourceId":"wf:R9","targetDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","targetId":"uc:UC-DATA-02","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6dcd9f1d4267fe9988ac500ca9fc699acc0eb150aa0c7a14962293e41a2f6336","properties":{"control_id":"PT-4","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pt-4-c254ba98.json","targetId":"ctrl:nist-800-53:PT-4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:70676750bd6879fd40a2faf14afa3200ede764d0931ad976dccfc0a71a8cc412","properties":{"control_id":"P2.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-soc2-p2-1-3e8a1b5b.json","targetId":"ctrl:soc2:P2.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:79eff9273f79143b6398cfbda69f47579dc0ad6193385ab69e0a9ac037a7c5fe","properties":{"control_id":"CCPA-1798.120-121","coverage":"partial","delta":"under-16 opt-in consent before selling/sharing minors' data not addressed","framework":"ccpa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"CCPA (2018) as amended by CPRA (2020)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-ccpa-ccpa-1798-120-121-7655ba5c.json","targetId":"ctrl:ccpa:CCPA-1798.120-121","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7aa69c83502aa3c57c2105fbc3bdea5adaba879e297214818886752faa90e9d2","properties":{"rationale":"Freely-given consent with withdrawal/opt-out as easy as opt-in partly counters take-it-or-leave-it asymmetry.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-privacy-power-imbalance-self-determination-9112ad1d.json","targetId":"risk:privacy-power-imbalance-self-determination","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:900f2470ca4c4df7af12d284683862a42ee705902d2e28bfa5295b4ffbc5620f","properties":{"rationale":"Presenting choices/consequences clearly and capturing freely-given, specific, informed consent directly counters misleading dark-pattern consent flows.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-data-transparency-notice-dark-patterns-9326fdf0.json","targetId":"risk:data-transparency-notice-dark-patterns","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91009775ad3f068d3dc9c55e3e41cb9b4a1800e0aff8127b232b2f778cb7108b","properties":{"rationale":"Valid consent capture, records, and honored withdrawals/opt-outs remove the defective-consent-mechanism driver of fines and private actions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-data-privacy-program-noncompliance-ec6178fa.json","targetId":"risk:data-privacy-program-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:985a5440dadf75eb79883d674ef43dd30259271ae6623cd5b1ded6eb4dd4839f","properties":{"control_id":"HIPAA-164.508","coverage":"partial","delta":"when authorization is mandatory (marketing, sale of PHI, psychotherapy notes) not established","framework":"hipaa","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"45 CFR Parts 160/164 (Security, Privacy, Breach Notification)"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-hipaa-hipaa-164-508-208be590.json","targetId":"ctrl:hipaa:HIPAA-164.508","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ad33ac7214bf5abb5e5dd0089a9c14fc9612faa45a4d37273341850d8bc9bbee","properties":{"rationale":"Honoring consent choices and opt-outs meets privacy expectations, sustaining individual trust.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-privacy-loss-of-trust-a4d1142c.json","targetId":"risk:privacy-loss-of-trust","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f8a9b35ebf87a8590053c572fd70acb37c0ac4d6ea91bfbdbf83472cb4721f7e","properties":{"control_id":"P3.2","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/ctrl-soc2-p3-2-0bc183ca.json","targetId":"ctrl:soc2:P3.2","type":"maps_to"}],"schemaVersion":1}