Consent Information Form Template for England and Wales

When your organization needs to collect and process personal data in England and Wales, obtaining proper consent requires more than a simple checkbox. You need a comprehensive Consent Information Form that meets strict legal requirements under UK GDPR and the Data Protection Act 2018. This document serves as your legal foundation for data processing, ensuring both compliance and transparency with data subjects.

When do you need this document?

You must use a Consent Information Form whenever consent serves as your lawful basis for processing personal data. This includes collecting customer information for marketing purposes, processing employee data beyond contractual requirements, conducting research involving personal information, or handling special category data such as health records or biometric information. Healthcare providers need this form when treating patients outside emergency situations, while schools require it for processing student data beyond educational necessities. Marketing companies must obtain explicit consent before processing data for promotional activities, and any organization collecting data from children under 13 needs parental consent through this formal process.

Key legal considerations

Your Consent Information Form must meet stringent requirements to ensure validity under English and Welsh law. The consent must be freely given, specific, informed, and unambiguous, with clear positive action required from the data subject. You cannot use pre-ticked boxes or assume consent through silence or inactivity. The form must clearly explain your identity as the data controller, provide contact details including your Data Protection Officer if applicable, and specify exactly what data you're collecting and why. You must detail how long you'll retain the information, who you might share it with, and the data subject's rights including the fundamental right to withdraw consent at any time. For special category data, you need additional safeguards and must clearly justify the processing necessity. The language must be accessible and understandable to your target audience, avoiding complex legal jargon that might confuse data subjects.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, your Consent Information Form must include specific mandatory elements to achieve legal compliance. You must clearly state the purpose and legal basis for processing, provide your organization's identity and contact details, and specify the categories of personal data involved. The form must explain data retention periods, detail any automated decision-making processes, and outline the data subject's rights including access, rectification, erasure, and portability. When processing children's data, you must verify parental responsibility and ensure age-appropriate language and presentation. The Mental Capacity Act 2005 requires additional considerations when obtaining consent from individuals who may lack capacity, necessitating clear assessment procedures and alternative consent mechanisms. Your form must also comply with the Human Rights Act 1998 by respecting privacy rights and personal autonomy. Additionally, the Consumer Rights Act 2015 mandates fair and transparent terms when consent relates to consumer services, ensuring no unfair clauses that might invalidate the consent process.