Authorisation Disclosure Form Template for England and Wales

When you need to share confidential information or personal data with third parties in England and Wales, an Authorisation Disclosure Form provides the legal framework to do so compliantly. This document serves as explicit written consent from the data subject, authorizing specific organizations to disclose particular information to designated recipients for defined purposes.

When do you need this document?

You require an Authorisation Disclosure Form whenever you're handling personal data or confidential information that needs to be shared beyond its original purpose. Healthcare providers use these forms when sharing medical records with specialists, insurance companies, or legal representatives. Employers need them when providing employment references or sharing employee information with pension providers, occupational health services, or during due diligence processes. Financial institutions require authorization before disclosing account details to accountants, solicitors, or family members. Educational institutions use these forms when sharing student records with prospective employers or other academic institutions. Public bodies often require authorization before releasing information under Freedom of Information Act requests that involve personal data.

Key legal considerations

The form must clearly identify all parties involved, including the data subject, the disclosing organization, and the receiving party. The scope of authorization section requires precise specification of exactly what information will be disclosed - vague or overly broad descriptions could invalidate the consent. You must include a clear statement of the purpose for disclosure, as sharing information beyond the stated purpose would breach data protection laws. The duration clause is critical, as indefinite authorization is generally not acceptable under UK GDPR principles. Include withdrawal provisions that allow the data subject to revoke consent at any time, though this may not apply to disclosures already made. Consider including limitations on further sharing by the receiving party to prevent onward disclosure without additional consent. The declaration section should confirm the data subject understands the implications of their authorization and is providing informed consent.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, consent must be freely given, specific, informed, and unambiguous. The form must use clear, plain language that the average person can understand, avoiding legal jargon or technical terms. You must provide information about data subject rights, including the right to withdraw consent and lodge complaints with the Information Commissioner's Office. For special category personal data (health, criminal records, biometric data), you need to meet higher standards of consent and may require additional legal bases. The Privacy and Electronic Communications Regulations apply if disclosure involves electronic communications or marketing activities. Article 8 of the Human Rights Act 1998 requires balancing disclosure against privacy rights, particularly in sensitive cases. Common law confidentiality duties remain relevant, especially in professional relationships like doctor-patient or solicitor-client. Organizations must maintain records demonstrating valid consent was obtained and be able to prove the authorization covers the specific disclosure made.