5.4 a) Types of Consent Explicit Consent: Subject gives clear, documentable consent e.g. Tick a box, sign a form, send an email or sign a paper b) Opt-in Consent: you are out, except you choose to opt-in. An example of opt-in consent is set out below: I want to receive XXX newsletter If the box is left unticked, you will not receive the XXX newsletter 5.5 Processing of a Child’s Data (Art. 3.1 NDPR) A child for the purpose of the NDPR shall be any person below thirteen (13) years. A data controller or processor whose processing activity targets children shall ensure its privacy policy is made in a child-friendly form with the aim of making children and their guardians have clear understanding of the data processing activity before grant of consent. 5.6 Consent to Cookies (Art. 2.5(d) NDPR) The use of cookies on a website or other digital platforms requires consent. The consent must be freely given, informed and specific. Consent for cookies does not necessarily need the ticking of a box or similar methods; the continued surfing of a website upon a clear notice indicates consent. In deploying cookies, website owners are required to: i. make cookie information clear and easy to understand; ii. Notify users of the presence and purpose of the cookies; iii. identify the entity responsible for the use of the cookies; and iv. provide information on how to withdraw consent from the use of the cookie. 6. DATA PROTECTION AUDIT (Art. 4.1(5) NDPR) 6.1 Data protection audit is a systematic investigation or examination of the records, processes and procedures of Data Controllers and 13 | P a g e