The consent as one of the legal bases for the processing of personal data is maintained, but the new legislation defines requirements for giving the consent. Under the new conditions, consent to the processing of personal data must be freely given, specific, informed and unambiguous, given in the form of a statement or by a clear affirmative action of the data subject. The data controller must still be able to demonstrate at any time that he was given the consent. It is clear from this definition that it is not enough to give consent in the form of accepting commercial terms and condition which include the consent. A default indication of consent to personal data processing will neither be sufficient. Nevertheless, in principle this is only a formalisation of the existing application practice by supervisory authorities. The data subject has got the right to withdraw his or her consent at any time, and the withdrawal of consent must be as simple as giving consent.