Where consent is relied upon, it must meet the requirements of the UK GDPR, including being freely given, specific, informed and capable of being withdrawn.As data protection legislation is reserved, oversight and enforcement sit with the UK data protection regulator, the Information Commissioner’s Office. S6W-44353