Art. 19 (2a) DGA:

"The entity shall provide tools for obtaining consent from data subjects or permissions to process data made available by data holders. The entity shall also provide tools for easy withdrawal of such consent or permission."

Art. 19a (1) DGA:

"The Commission shall adopt delegated acts in accordance with Article 28, supplementing this Regulation by establishing a rulebook, laying down:

[...]

(b) appropriate technical and security requirements to ensure the appropriate level of security for the storage and processing of data, as well as for the tools for obtaining and withdrawing consent and permission;

[...]"