| Situation | Rule |
|---|---|
| Initial data collection | Meaningful consent required before or at collection |
| New purpose (post-collection) | Fresh consent required |
| Highly sensitive data (medical) | Express (not implied) consent required |
| Withdrawal | Client may withdraw at any time, subject to legal/contractual limits |
| Cross-border transfer | Must be disclosed; third-party must provide comparable protection |