Consent To Disclose Personal Information Form Template for England and Wales

A Consent To Disclose Personal Information Form is a crucial legal document that authorizes the sharing of personal data between organizations under England and Wales law. This form ensures you comply with strict UK GDPR requirements while protecting individuals' privacy rights and your organization from potential data protection violations.

When do you need this document?

You need this form whenever you plan to share personal information with external parties beyond your normal business operations. Healthcare providers use these forms before sharing patient records with specialists or insurance companies. Educational institutions require consent before disclosing student information to potential employers or other educational bodies. Financial services use them when sharing client data with credit agencies, auditors, or regulatory bodies. Legal firms need consent before sharing client information with barristers, expert witnesses, or other legal professionals. Even HR departments require these forms before sharing employee information with pension providers, healthcare insurers, or background checking services.

Key legal considerations

The form must clearly specify what personal information will be disclosed, ensuring you don't share more data than necessary for the stated purpose. You must identify all recipients of the information, including their relationship to your organization and how they will use the data. The purpose for disclosure must be specific and legitimate, avoiding vague language that could lead to scope creep. Include a clear timeframe for how long the consent remains valid and establish procedures for the recipient to handle the data responsibly. Most importantly, you must inform the data subject of their right to withdraw consent at any time and provide a simple mechanism for doing so. The form should also explain any consequences of refusing consent, ensuring the individual can make an informed decision.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, consent must be freely given, specific, informed, and unambiguous. The consent mechanism must be clear and distinguishable from other matters, meaning you cannot bury consent within general terms and conditions. Pre-ticked boxes or assumed consent are not legally valid. The form must use plain English that the average person can understand, avoiding legal jargon or technical terms without explanation. You must maintain records of when and how consent was obtained, including evidence that the individual was properly informed. For special category data such as health records, ethnicity, or criminal history, you need explicit consent and additional safeguards. The Information Commissioner's Office requires that consent requests are prominent and separate from privacy policies. If you're sharing data with recipients outside the UK, you must ensure adequate protection measures are in place and inform the data subject about international transfers.