Consent to receive commercial electronic messages is either express, or reasonably inferable from how the person or organisation has behaved and from its existing business or other dealings with the sender. A person other than the account-holder who uses the account to give, withdraw or refuse consent is taken to act with the holder's authority (cl 3), and regulations may say when consent may or may not be inferred (cl 5; none are made). Because s 16(5) puts the evidential burden on the sender, the organisation keeps proof of which basis applies to each address and why the inference is reasonable.
This control maps to 4 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.