Any consent required to be given, by a data subject, to the

processing of personal data—

(a) means any informed, specific, unequivocal, freely given,
expression of will by which the data subject agrees to the
processing of that data subject’s personal data;
(b) includes any such expression of consent given by—
(i) the legal personal representative of the data
subject;
(ii) any individual to whom the data subject delegates,
in writing in such form and manner as may be
prescribed, the right to give or withhold consent
to the processing;
(iii) in the case of a minor, (subject to section 5(a)(i)),
a parent or legal guardian of the minor; or
(iv) in the case of an individual who by reason of any
mental impairment is unable to act, the person
entitled to act for that individual under section
5(a)(ii); and
(c) may be withdrawn in the same manner in which it may be
given under paragraph (a).
(2) For the purposes of subsection (1)—
(a) “informed” with reference to the giving of consent means
that at the time in question the data subject is informed about
how the personal data will be processed, including the
purpose for which the data will be used and the class of
persons to whom the personal data may be transferred; and
(b) consent is not freely given if the data subject is required, as a
condition for the provision of any goods or services to the
data subject, to consent to the collection, use or disclosure
of the data subject’s personal data beyond what is reasonable
for the provision of those goods or services.
10.—(1) A data controller shall not process personal data of a data
subject for the purpose of direct marketing unless the data subject—
(a) consents to the processing for that purpose; or
(b) is, subject to subsection (4), a customer of the data controller.
(2) A data controller shall not approach a data subject, whose
consent is required in terms of subsection (1)(a), more than once in
order to request that consent.
(3) A request for consent in terms of subsection (1)(a) shall be
made in the prescribed form and manner.
(4) A data controller may, pursuant to subsection (1)(b), only
process the personal data of a data subject who is a customer of that
data controller—
(a) if the data controller has obtained the contact details of the
data subject in the context of the sale of any goods or
services;
(b) for the purpose of direct marketing of the data controller’s
own similar goods or services; and
Subject to subsection (3), on any of the grounds set out in
subsection (2) an individual is entitled at any time, by notice in writing to
the data controller, to require the data controller—
(a) within a period which is reasonable in the circumstances, to
cease; or
(b) not to begin,
processing, or processing for a specified purpose or in a specified
manner, any personal data in respect of which the individual is the data
subject.
(2) The grounds referred to in subsection (1) are that, for
reasons which shall be specified in the notice under subsection (1)—
(a) the processing of the personal data, or the processing of the
personal data for that purpose or in that manner, is causi