Adds a definition of consent to Part 3 of the 2018 Act and new section 40A: a competent authority relying on consent must be able to demonstrate it, separate the request in a written document, allow withdrawal as easily as giving it and tell the data subject beforehand, and consider whether a service was made conditional on unnecessary consent. The duty itself is modelled on the 2018 Act leaf cross-referenced here.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.