Authorisation For Release Of Personal Information Template for England and Wales

An Authorisation For Release Of Personal Information is a legal document that allows you to control how your personal data is shared between organizations or individuals. Under England and Wales law, this document ensures compliance with UK GDPR and the Data Protection Act 2018, providing a lawful basis for data processing and transfer. The authorization clearly specifies what information can be disclosed, who can receive it, and the specific purposes for which it will be used.

When do you need this document?

You need this authorization whenever personal data must be shared beyond the original purpose for which it was collected. Healthcare providers require it when sharing medical records with specialists or insurance companies. Employers use it when providing references to prospective employers or when releasing payroll information to mortgage lenders. Financial institutions need it when sharing account details with legal representatives or family members. Educational institutions require authorization before releasing academic records to third parties. Legal professionals use it when accessing client information from other service providers or when sharing case-related data with expert witnesses.

Key legal considerations

The document must clearly identify the data subject and specify their relationship to any third party making the request. You should define the exact scope of information being authorized for release, avoiding broad or vague descriptions that could lead to excessive data sharing. The authorization must state the specific purpose for data release and include clear time limitations to prevent indefinite use. Consider including restrictions on further disclosure by the recipient and requirements for secure handling of the information. The document should specify whether it covers special category data such as health records, criminal convictions, or biometric information, which require additional safeguards under UK GDPR. Include provisions for withdrawing consent and ensure the authorization complies with the lawfulness principles requiring data processing to be fair, lawful, and transparent.

Legal requirements in England and Wales

Under England and Wales law, the authorization must comply with UK GDPR Article 6 lawful bases for processing, typically relying on consent or legitimate interests. For special category data, you must also satisfy Article 9 conditions, such as explicit consent or substantial public interest. The document must be freely given, specific, informed, and unambiguous to meet UK GDPR consent standards. Data controllers must maintain records of the authorization and ensure recipients understand their obligations under UK data protection law. The Information Commissioner's Office requires that data subjects receive clear information about their rights, including the right to withdraw authorization and lodge complaints. Organizations must implement appropriate technical and organizational measures to protect personal data during transfer and ensure compliance with data minimization principles throughout the process.