Tracking Consent and Legal Basis for Contact Data

:::caution Legal note The approach described here helps you record consent and legal basis information. It does not constitute legal advice, and implementing it does not guarantee compliance with any specific regulation. Consult qualified legal counsel to determine your obligations under applicable laws such as GDPR, CCPA, TCPA, or others that apply to your business. :::

Many data protection frameworks require organizations to demonstrate a lawful basis for processing personal data. The platform does not include dedicated built-in consent fields. Instead, the recommended approach is to build a consent-tracking layer using custom fields, workflows, and DND actions — giving you full control over what you capture, how it is populated, and how it is enforced.

---

Step 1: Create consent custom fields

Define the fields you want to track in Settings → Custom Fields. These are the fields that will appear on every contact record and can be populated manually or by workflow.

Suggested fields (name them to suit your team’s convention):

Suggested field name	Field type	Purpose
Consent Source	Single-line text	Where consent originated (e.g., “web form”, “phone call”, “contract”)
Consent Method	Single-line text	The mechanism used (e.g., “opt-in checkbox”, “signed document”)
Opt-in Timestamp	Date / Date+Time	When consent was given
Consent Notes	Multi-line text	Free-text detail: exact language shown, document references, etc.
Legal Basis	Dropdown	The lawful basis category (e.g., “Consent”, “Legitimate Interest”, “Contract”)

These are examples — create the fields that reflect your actual compliance requirements. None of them are built into the contact record by default; you define them.

To create a field:

1. Go to Settings → Custom Fields.
2. Click Add Custom Field.
3. Choose the appropriate field type.
4. Set the Object Type to Contact.
5. Assign a Group Tab (e.g., “Compliance” or “Consent”) so the fields are easy to find on the contact profile.
6. Click Save.

---

Step 2: Populate consent fields automatically with a workflow

The most reliable way to maintain an accurate consent record is to capture it at the point of data entry — automatically, without manual work.

For form or survey submissions:

1. Add an explicit opt-in checkbox to your form or survey.
2. Create a workflow triggered by Form Submitted (or Survey Submitted).
3. In the workflow, add an Update Contact Field action.
4. Map each custom field (Consent Source, Opt-in Timestamp, etc.) to the value you want to write — for example, set Consent Source to “Website opt-in form” and Opt-in Timestamp to the submission date.
5. Optionally, add a DND Contact action immediately after to enable or disable specific channels based on what the contact selected.

Using this pattern, every contact who submits the form receives consistent, accurate consent records automatically.

For contacts added manually or via import:

• Manual entry: open the contact record, scroll to the consent field group, and fill in the fields directly. Establish a team-wide convention for consistent values.
• CSV import: include columns in your import file that match the custom field names exactly. The importer maps them automatically.

---

Step 3: Pair with DND for enforcement

Custom fields record what consent was given; DND actions enforce whether a channel can be used. Use both together:

• In the workflow above, add a DND Contact action to enable DND on channels the contact did not opt into.
• In Smart Lists, filter by both consent field values and DND status to verify that your enforcement is consistent.

For details on DND configuration, see the DND article.

---

Step 4: Filter and export for audits

Because consent data lives in custom fields, you can use Advanced Filters in the contact list or Smart List to slice by any value:

• Contacts where Consent Source Is “web form”
• Contacts where Opt-in Timestamp Is Before a cutoff date
• Contacts where Legal Basis Is Empty (missing records that need follow-up)

To export for an audit or regulatory request:

1. Apply the filters you need.
2. Click Export in the contact list toolbar.
3. Choose All Fields (or select the specific fields) — your consent custom fields will be included in the CSV output.

---

Reviewing consent records periodically

Schedule a recurring Smart List review:

1. Build a Smart List filtered to contacts where any consent field Is Empty or where Opt-in Timestamp Is Before a specific date.
2. Assign a team member to review and update those records on a defined schedule.
3. Use the workflow approach above for any re-consent campaigns that update the fields automatically.

---

Frequently asked questions

Are there built-in consent fields on the contact record? No. The platform does not include dedicated built-in fields named “Consent Source,” “Consent Method,” or “Consent Notes.” You create them as custom fields in Settings → Custom Fields so you can define exactly what to track.

Do I have to fill in these fields for every contact? Custom fields are optional in the system. Whether you are required to populate them depends on the regulations applicable to your business. Your legal counsel can advise on that obligation.

Can I make consent fields mandatory before a contact can be messaged? You can enforce this at the workflow level — for example, by withholding a tag or DND configuration that enables outbound messaging until the consent fields are populated. There is no system-level enforcement that blocks saving a contact without them.

Does recording consent this way satisfy GDPR or other regulations? This approach provides a structured, auditable way to store consent information, but regulatory compliance depends on many factors beyond what you record in software. Consult qualified counsel for guidance specific to your situation.

Can consent data be exported? Yes. Contact exports include all custom fields. Your consent custom fields will be included in a CSV export of contacts.