Consent Authorisation Form Template for England and Wales

When you need to obtain explicit permission to process personal data or undertake specific actions involving individuals, a Consent Authorisation Form provides the legal framework required under England and Wales law. This document ensures compliance with GDPR and UK data protection legislation while protecting both your organization and the individuals whose consent you're seeking.

When do you need this document?

You'll need a Consent Authorisation Form whenever you're processing personal data that requires explicit consent as the lawful basis under GDPR. This includes processing special category data such as health information, biometric data, or data revealing political opinions. The form is also essential when you're seeking consent for marketing communications, sharing data with third parties, or processing data for purposes beyond your original collection reason. Healthcare providers, educational institutions, employers, and marketing agencies frequently rely on these forms to ensure lawful data processing. Additionally, you'll need this document when obtaining consent from or on behalf of individuals who may lack mental capacity, ensuring compliance with the Mental Capacity Act 2005.

Key legal considerations

Your Consent Authorisation Form must meet strict legal requirements to be valid under UK law. The consent must be freely given, specific, informed, and unambiguous, with clear positive action required from the individual. You cannot use pre-ticked boxes or assume consent from silence. The form must clearly explain what data you're collecting, why you're processing it, and who you might share it with. You must include information about the individual's right to withdraw consent at any time and how they can exercise this right. For special category data, you need to explain why processing is necessary and ensure you have both a lawful basis under Article 6 and a special category condition under Article 9 of GDPR. When dealing with children under 13, you must obtain parental consent, and for those aged 13-18, you should consider their maturity level and the context of the data processing.

Legal requirements in England and Wales

Under the Data Protection Act 2018 and UK GDPR, your Consent Authorisation Form must comply with specific documentation requirements. You must keep records demonstrating how and when consent was obtained, including the information provided to individuals and their clear consent actions. The form must be written in plain English, avoiding legal jargon that could confuse individuals about what they're agreeing to. For individuals lacking mental capacity under the Mental Capacity Act 2005, you must follow best interests procedures and may need to obtain consent from appointed representatives or the Court of Protection. The Human Rights Act 1998 also requires that your consent processes respect individuals' rights to privacy and autonomy. You must regularly review and refresh consent, particularly for ongoing processing activities, and maintain audit trails of all consent management activities for potential regulatory scrutiny.