One of the main changes introduced by the GDPR is to define a clear framework of responsibility for data protection. A data controller can only appoint subcontractors who offer “sufficient guarantee” that the requirements of the GDPR are met. A processor can only respond to the controller`s “documented instructions” and must meet a number of requirements to ensure that the controller fulfils its obligations under the GDPR. “Mandatory consent” means express and voluntary consent that has not been revoked in writing by the data subject. If the person concerned is a minor (i.e. under 18 years of age), a person with parental responsibility may give the required consent on his or her behalf in respect of the minor. PPS 3 provides that personal data should only be used for the initial purposes for which they were collected or for directly related purposes.. . .

.