Checklist · Onboarding Governance
Privacy and Consent Evidence in Client Onboarding
Separate notices, lawful-basis decisions and optional consent choices, preserving versions, timestamps, withdrawals and access restrictions in onboarding.
Published Updated
Published by FxTrusts, a supplier of brokerage and prop firm technology. Prepared with AI-assisted research and drafting; reviewed against the cited public sources. Examples are illustrative. Product links describe our services.
Quick answer
A privacy evidence record distinguishes what the person was told, why each processing purpose is lawful and which choices they made. Preserve notice versions, purpose-specific decisions, consent evidence where consent applies, and later changes. A generic accepted checkbox does not prove valid consent for every use of onboarding data.
Map purposes before choosing a checkbox
List the actual processing purposes: establishing a relationship, identity review, maintaining required records, sending service messages or optional marketing. Ask the responsible privacy owner to assess the applicable lawful basis and any additional conditions. Do not present consent as the only possible basis or combine unrelated purposes into a single ambiguous choice.
The ICO's UK guidance explains why seeking consent can be misleading when processing would continue on another basis regardless of refusal. That is framework-specific guidance, not a worldwide determination for a forex business. Use the applicable law and current advice for the operator, people, data and activities involved.
Sources for this section
Preserve the notice and the actual choice
Record the notice or form version shown, date and context, relevant purpose and the action taken. Keep an archived copy of the text rather than a link that always opens today's policy. Distinguish acknowledgment of a notice from consent to a particular optional activity. If the person changed a preference, preserve the old and new states with their effective times.
Where consent is the basis, the ICO describes evidence of who consented, when, how, what they were told and whether they withdrew. Build those fields into the record without unnecessarily retaining full browser fingerprints or unrelated personal data. A timestamp alone cannot reconstruct the text or choice available at the time.
Sources for this section
Implement changes across the data flow
Identify which systems receive each preference or restriction, who controls them and how updates are confirmed. An optional marketing withdrawal should reach the relevant sending systems; merely changing a CRM display does not prove that communications stop. Reconcile failed updates and retain a controlled event reference.
Assess retention and access separately. A withdrawn optional consent does not automatically resolve lawful recordkeeping obligations for another purpose. The privacy owner should document the relevant basis and retention treatment, while operational logs avoid copying unnecessary sensitive content. Review changes to forms, providers and purposes before assuming old evidence covers a new use.
Example: notice acknowledgment and optional marketing differ
In a fictional onboarding flow, a person acknowledges notice version 4 and separately chooses optional product emails. The record links each action to its own purpose and timestamp. A later withdrawal disables that email preference and is confirmed in the sending system. The organization separately assesses which onboarding records it must retain under the applicable framework; it does not claim that the original marketing checkbox authorizes all retention.
| Record | What it explains |
|---|---|
| Purpose and basis assessment | Why the processing occurs |
| Notice version and archived text | What was communicated at that time |
| Specific choice and timestamp | What the person actually selected |
| Withdrawal or preference change | When and how the choice changed |
| Propagation result | Which dependent systems applied the update |
Implementation checklist
- Map processing purposes and obtain the appropriate basis assessment.
- Separate notice acknowledgment from optional consent choices.
- Archive the exact text and evidence of each relevant action.
- Confirm preference changes downstream and review retention separately.
Sources
These documents support the reference. Check the original publication for current requirements and the limits of its scope.
Continue with the broader guides
Connect this reference to platform selection and the wider operating workflow.