The company has a formal policy for capturing and managing individual consent for data processing
A policy on when consent is required and how it is withdrawn is one concrete legal obligation this control's register needs to include.
Defining in writing when consent is the legal basis, how it must be captured, and how withdrawal works as easily as giving it sets the policy A.5.34 needs for protecting personal data, though consent capture and enforcement still have to happen in practice.
https://sekit.ai/api/mcp/crosswalk