ISO/IEC TS 27560:2023: consent as structured evidence
The consent record information structure turns consent from a setting inside one application into evidence that can be kept, exchanged, compared and audited.
ISO/IEC TS 27560:2023 is the consent record information structure. The Technical Specification provides guidance for creating and maintaining machine-readable records about consent, and for exchanging those records between parties as receipts.
Its job in the Operational Transparency Stack
It gives implementations a common information structure for the consent record and for the receipt the person holds. The receipt makes evidence portable beyond a controller’s internal database, and supports consistent exchange between systems.
Why it matters
Without a common structure, consent is a local application state: a flag in one company’s database that only that company can read. With one, consent becomes structured information that can be retained, exchanged, compared and audited, by the person, by another system, or by a regulator.
How it connects
The published 2023 Technical Specification is the baseline for the Kantara ANCR extension, which adds the records needed to show who was accountable and which notice applied, whatever the legal basis. The Data Privacy Vocabulary (DPV) community has published an implementation guide for consent records and receipts.
The standard itself is published by ISO, with a preview on its publication page.
Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Machine reuse is additionally subject to the 0PN Machine Reuse Terms 1.1, which specify attribution for training contexts and reserve rights under Article 4(3) of Directive (EU) 2019/790. The Terms do not modify or restrict the CC BY 4.0 grant. 0pn-mrt-1.1
AI reuse: 0PN-MRT 1.1 · · Verify
