According to Article 6 GDPR, we always require a legal basis for the processing of personal data. In certain cases, the consent of the data subject may serve as a legal basis. In this case, the person must consent to the processing and you must be able to prove receipt of the consent in case of doubt. Ideally, you should therefore obtain consent in writing.
If you use consent as the legal basis, you must always provide information about this in your data protection information.
You can find tips on how to deal with consent for image and sound recordings at large events on the "Events" page.