Authorisation To Disclose Information Template for England and Wales

When you need to share confidential or personal information in England and Wales, an Authorisation To Disclose Information provides the legal framework to do so safely and compliantly. This document establishes formal consent for data sharing while protecting all parties' rights and ensuring compliance with strict UK data protection laws. You'll use this authorization to create a clear record of what information can be disclosed, to whom, and for what specific purposes.

When do you need this document?

You'll need this authorization when sharing personal data between organizations, such as when an employee moves between companies and their HR records need transferring. Healthcare providers use these authorizations when sharing patient information with specialists or insurers. Legal professionals require them when disclosing client information to third parties like expert witnesses or other advisors. Financial institutions use these documents when sharing customer data with credit agencies or regulatory bodies. Educational institutions need them when providing student records to potential employers or other schools.

Key legal considerations

The scope of authorization must be clearly defined to specify exactly what information can be disclosed. You must establish a legitimate lawful basis under UK GDPR, whether through explicit consent, legitimate interest, or another applicable ground. The document should include duration limits to prevent indefinite data sharing and specify the permitted purposes for using the disclosed information. Consider including restrictions on further disclosure to third parties and requirements for data security measures. Special category data, such as health records or criminal convictions, requires enhanced protection and explicit consent provisions. You should also address data subject rights, including the ability to withdraw consent and request copies of shared information.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, you must ensure any authorization meets specific consent requirements, including being freely given, specific, informed, and unambiguous. The document must clearly identify the data controller and any processors involved in handling the information. You need to provide transparency information about how the data will be processed, stored, and potentially shared further. Common law confidentiality duties may apply alongside statutory requirements, particularly in professional relationships like doctor-patient or solicitor-client contexts. The Freedom of Information Act 2000 may affect public bodies' obligations when disclosing information to individuals. For health records, the Access to Health Records Act 1990 provides additional framework requirements. Ensure your authorization includes provisions for data retention limits and secure disposal methods when the authorization expires.