M9-03 GDPR — Consent Management

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3 Requirement Clarity: ✅ Clear Dev Status: ❌ Not started

Overview

Capture and record clear candidate consent before sharing their personal information with third parties (e.g. during disclosure/verification), and make that consent auditable.

Backend Tasks

• Add a consent-capture step to the disclosure flow (M5-07) and reclaim flow (M7-05)
• Store consent records in a way that's queryable for audit/SAR purposes

Frontend Tasks

• Add consent capture UI at the relevant candidate touch-points

Dependencies

• M5-07 wallet disclosure integration
• M7-05 candidate consent flow — reclaim protocol already has a specific consent design; reuse the same underlying consent-record model here rather than building two.

Acceptance Criteria

• Clear user consent must be sought for sharing personal information with third parties
• Support consent capture and auditability (per SOW NFR3, Appendix 6 Security Requirements)

Existing Reference Material

• ../M7/M7-05-candidate-consent-flow.md

Blockers & Risks

None identified — mostly a matter of building one consent model and applying it in two places (disclosure, reclaim).