How consent works at Essence: purpose, fields, revocation, receipts
Every field shared from an Essence vault has its own consent record: terms the person sets, a withdrawal they control field by field, and a receipt both sides can read.
An organisation that receives personal data is often asked to show on what terms it got it. The person who shared it wants to know what they agreed to, and how to take it back. On Essence, both answers sit in one place: the consent record behind every share. Data leaves a vault only when a consent record says it may.
One record for every shared field
A consent record, which the platform calls a grant, is the decision to share, written down. It names who is sharing, who is receiving, what is shared and on what terms.
Consent works field by field. Each shared field has its own record, so a person who shares a date of birth and an address with an organisation can later withdraw the address and leave the date of birth in place. Nobody has to choose between sharing everything and sharing nothing.
Consent and encryption do separate jobs. The grant decides whether access is allowed. Encryption makes sure the shared fields can be read only by the recipient, and our explainer on how your vault is encrypted covers it.
What a grant can record
In the app, sharing takes a few choices: the recipient, read or download access, a purpose and an expiry. We recommend always setting an expiry. Behind that screen, a grant can carry more terms than many sharing tools record:
- Limits on use. An expiry date, an optional maximum number of accesses, and whether the recipient may download, print or forward.
- A lawful basis. Since our August release, a grant can record the GDPR Article 6 basis it rests on, why that basis applies, and how long the recipient may keep the data once the grant ends. These are fixed when the grant is made and cannot be rewritten later.
- A purpose. Since our October release, a grant to an organisation can be tied to a stated purpose, with an expiry that must be set and a record of any revocation.
- Sub-processors and cadence. Also since our October release, a grant can record the list of sub-processors the person was shown and the rule they chose for later changes to it. It can declare how often the recipient may return, so a one-off look cannot quietly become a standing feed.
Where a grant does not record a lawful basis or a cadence, the platform shows "not declared" rather than filling in a default. A record never claims more than was agreed.
Paused, ended or lapsed
A grant is usually in one of four states: active, suspended, revoked or expired. The platform also records a refused request, a grant that has lapsed, a legal hold, and changes awaiting confirmation, during which access is refused.
Suspension is the state worth knowing about. It blocks access without ending the grant, for example during a regulatory hold or a dispute, and the grant can resume afterwards.
Some sharing is ongoing rather than one-off. For these, the person chooses how updates flow: every change as it happens, only between two dates, a set number of times, or with their approval before each one.
When a share connects two of the platform's country instances, each side keeps its own copy of the grant and enforces it locally. Where data is held, and what crosses a border, is the subject of our explainer on where your data lives.
What withdrawing does
A person can revoke a whole grant or a single field. On their own instance, revocation takes effect at once. Where a share crosses to another country's instance, that instance refuses all access while the revocation is on its way.
What withdrawal achieves depends on the lawful basis recorded on the grant, and the platform says so beside the revoke control:
- Under consent, withdrawing means the processing must stop.
- Under a legal obligation or a public task, Essence stops disclosing, and the recipient may keep using what it already holds, under its own authority.
Revoking stops future access. What the person can ask of copies a recipient already holds, such as objection or erasure, depends on the lawful basis; Consent and the lawful basis (essence.digital/knowledge/consent-and-the-lawful-basis) sets out how.
When a person withdraws, the platform seals a fingerprinted snapshot of the grant as it stood. The withdrawal and its time appear in the share's history, which the person can read.
A receipt both sides can read
Both parties to a grant can read a consent receipt from the platform. It shows the purpose, a reference to what was shared rather than the data itself, when the grant was made and when it expires, whether it can still be revoked, the lawful basis, the retention period and what withdrawal does.
The receipt carries no personal data and no key material. Either side can read it as a statement of the terms without it becoming one more copy of the data it describes.
For a person, consent on Essence is specific: they set the terms and can take back any part of them. For an organisation, every field it receives arrives with its own record of those terms, held with the grant itself, which is the evidence a data protection team is asked for. If you would like to see how grants would fit your own processes, we would be glad to walk you through them.
Last reviewed 8 October 2026