Consider the following GDPR tips, regarding how to obtain consent to use personal data from the subjects involved:
•GDPR Articles 7, 8, and 21 (right to object), relate to the Data Subject (be it for an adult, or a child under due authorized consent) having the possibility to explicitly authorize or not, the use of personal data by a Data Controller.
Recall that you should not only obtain an explicit consent from those individuals involved in your processes, where it is clear that you may use personal data for the specified purposes, but also need to be able to demonstrate that such consent was given.
This is very applicable for individuals from whom you already have personal data in use.
Recall that you may need to modify your existing data model so that you include any fields to save evidence of the explicit consent (as being accepted and authorized by Data Subjects).
Alternatively, consider that consent can also be obtained outside of the use Bizagi, by means which involve your own internal policies and imply that individuals would have to sign contracts.