While the law recognizes the freedom of individuals to give consent, organisations have the duty to ensure that consents is not arbitrarily used as a basis for information processing. For consent to be valid, the organisation must demonstrate that the information collected is necessary for rendering its services, and that the use to which the information collected will be put has been explained to the data subject at the time of collection. Data minimization is an aspect of consent requirement. Data minimization requires that an organisation does not use consent as a basis to collect information in excess of what it requires to provide its services.