2. Policy Age and Staleness
What does ICO (Information Commissioners Office) say about Consent?
Keep consents under review and refresh them if anything changes. Build regular consent reviews into your business processes.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/consent
You should keep your consents under review. You will need to refresh them if anything changes – for example, if your processing operations or purposes evolve, the original consent may not be specific or informed enough. If you rely on parental consent, bear in mind that you may need to refresh consent more regularly as the children grow up and can consent for themselves. If you are in any doubt about whether the consent is still valid, you should refresh it. See ‘How long does consent last?’ for more on this.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/how-should-we-obtain-record-and-manage-consent
Configuration Parameters
When a member joins the Club, they have to agree to your club’s Privacy Policy. Over time, that policy may change, and some clubs want to make sure that members review and confirm it again every so often.
This may become more important if there are additional options that you create (Consent Option Definitions are covered later) which may increase the need for your club to consider how old consent is allowed to become.
Crossmember gives you two settings to control this behaviour. You can find them in:
Admin → Setup → GDPR(tab)
This article explains what each setting does, and how they work together.
There is a wealth of information on the ICO website regarding consent, here are just a couple of examples but you are encouraged to read their documentation thoroughly.
Consent Max Age (in Months)
This tells Crossmember how long a member’s consent remains “fresh” before it is considered “stale”.
When it is set to 0 months (the default)
This means:
- Consent never goes stale.
- Once a member has agreed to your Privacy Policy, that consent remains valid forever.
- Members will not be asked to re-consent, unless your policy changes – you create a new version.
- All GDPR reports will show everyone as “OK”.
This setting is perfect for clubs who prefer a simple approach and do not want to ask members for updated confirmations.
When you choose a number greater than 0
For example: 12 months, 24 months, 36 months, etc.
This means:
- Consent expires after that number of months.
- After expiry, their consent becomes stale.
- They will begin to show up on GDPR reports as needing consent.
- When they renew, Crossmember may send them a prompt asking them to review the policy again and tick the box.
This helps clubs who want to keep their consent records fresh — especially if they have additional consent options (covered later) that ought to be refreshed on a periodic basis.
Treat Stale Consent as No Consent (checkbox)
This option tells Crossmember how strict you want the system to be when consent goes stale.
If this box is not ticked
- A member with stale consent is still continues to receive all benefits entitled to them for their original consent even though it is now considered old / stale.
- They will show on reports as stale, but they are not blocked from anything.
- They will be prompted to re-consent, but their old consent still “counts” until they update it.
This is a gentler approach, suitable for clubs who want good housekeeping without inconvenience.
If this box is ticked
This is the strict mode.
- If a member’s consent becomes stale, Crossmember will treat them exactly as if they had never consented at all.
- Even though they did consent previously, the system acts as if that consent has lapsed completely.
- Reports will show them as stale and to be treated as no consent regardless of their previous selections.
- Crossmember may block certain actions (depending on your other settings) until they re-consent.
- When they renew, they will be directed back to their Member Record to tick the consent box again.
- The GDPR reports will provide granularity to enable Membership Secretaries to know who is approaching stale consent to ensure action is taken accordingly.
This is useful for clubs with stronger compliance requirements.
How these settings work together
Here are the four basic combinations:
Max Age 0 + Treat Stale as No Consent OFF
- Consent never expires.
- No member will ever be stale or blocked.
- Easiest and simplest setup.
Max Age 0 + Treat Stale as No Consent ON
- Same as above — because age 0 never produces stale consent.
- The second option never activates.
Max Age greater than 0 + Treat Stale as No Consent OFF
- Members become “stale” after the chosen number of months.
- They can still renew without issues.
- They are gently asked to re-consent.
- Reports highlight who needs attention.
Max Age greater than 0 + Treat Stale as No Consent ON
- Members become “no consent” when their consent ages beyond the limit.
- The club may enforce re-consenting more firmly.
- Reports clearly show who must act.
What your members will experience
When consent becomes stale or is treated as no consent:
- The renewal page may remind them that their consent needs updating.
- After they renew, Crossmember may guide them back to their Member Record to review the policy again.
- They simply tick the box — nothing else changes.
This keeps everything compliant without causing confusion.