Questio n: Under GDPR, the controller must demonstrate that data subjects have consented to the processing of their personal data, and the consent…

Under Article 7(1) of GDPR, controllers must be able to demonstrate that the data subject has given

consent. The DPO advises on ensuring these procedures are in place but does not collect or approve

consent directly.

Option B is correct because the DPO must verify that consent records exist and meet GDPR

standards.

Option A is incorrect because informing data subjects about withdrawal rights is the controller’s duty,

not the DPO’s.

Option C is incorrect because the DPO does not personally maintain consent logs.

Option D is incorrect because DPOs do not approve legal bases for processing—this is the controller’s

responsibility.

Reference:

GDPR Article 7(1) (Controller must demonstrate valid consent)

GDPR Article 39(1)(b) (DPO ensures compliance with data protection obligations)