​​The responsibility for obtaining consent lies with the data controller, i.e. the organization or entity that determines the purposes and means of processing personal data. Controllers are also responsible for the actions of any third parties doing data processing for them.
Data controllers must ensure that consent is obtained in accordance with GDPR standards before any personal data processing begins. They are also responsible for keeping records of these consents as proof that they were obtained lawfully.