Release Of Information Statement Template for England and Wales

Generate a bespoke document

Trusted by 200k+ teams

4.7 Capterra
4.8 Product Hunt
4.6 Trustpilot

What is a Release Of Information Statement?

A Release of Information Statement is essential when there is a need to formally authorize and document the sharing of personal or confidential information. This document, governed by English and Welsh law, ensures compliance with UK GDPR and related data protection legislation. It specifies what information can be shared, with whom, for what purpose, and under what conditions. The statement is particularly crucial in situations requiring audit trails of information disclosure and where formal authorization for information sharing is needed to protect all parties involved.

Frequently Asked Questions

Is a Release of Information Statement legally binding in England and Wales?

Yes, a properly executed Release of Information Statement is legally binding in England and Wales. It creates enforceable obligations under UK GDPR and the Data Protection Act 2018, specifying exactly what information can be shared and under what conditions. The document must clearly identify the parties, the information being released, and the lawful basis for processing to be legally valid.

Can I be prosecuted if my Release of Information Statement is missing or incomplete?

An incomplete Release of Information Statement can result in serious consequences under UK data protection law. The ICO can impose fines up to £17.5 million or 4% of annual turnover for UK GDPR breaches. Missing essential elements like lawful basis, data subject rights, or retention periods can constitute unlawful processing, leading to regulatory action and potential civil claims.

How long does it take to create a Release of Information Statement in England and Wales?

A straightforward Release of Information Statement typically takes 1-3 hours to prepare using a template, including time to identify the lawful basis and complete required details. Complex releases involving sensitive personal data or multiple parties may take several days, especially if legal review is needed to ensure UK GDPR compliance and proper risk assessment.

How is a Release of Information Statement different from a Data Sharing Agreement under UK law?

A Release of Information Statement is typically a one-off authorization for specific information sharing, while a Data Sharing Agreement establishes ongoing arrangements between organizations. The Release Statement focuses on consent or other lawful bases for a particular disclosure, whereas Data Sharing Agreements cover controller-processor relationships, security measures, and ongoing compliance frameworks under UK GDPR.

Must a Release of Information Statement include specific UK GDPR requirements?

Yes, under England and Wales law, the statement must identify the lawful basis for processing, specify data subject rights, include retention periods, and detail security measures. It must also clearly state the purpose of information sharing, identify all parties involved, and include contact details for data protection queries. These elements are mandatory under the Data Protection Act 2018.

Can someone refuse to sign a Release of Information Statement in England and Wales?

Generally yes, individuals have the right to refuse signing unless there's a legal obligation or legitimate interest that overrides their rights. Under UK GDPR, consent must be freely given, so coercion invalidates the release. However, certain circumstances like court orders, statutory requirements, or vital interests may permit information sharing without individual consent.

Which common mistakes invalidate a Release of Information Statement under UK law?

The most serious mistakes include failing to identify a valid lawful basis under UK GDPR, using vague language about what information is being released, omitting data subject rights information, and not specifying retention periods. Other critical errors include missing party identification details, unclear purposes for sharing, and failing to include required contact information for data protection queries.

Reviewed by

Swetha Meenal

Legal Engineer, GenieAI

Swetha Meenal profile photo

A lawyer, legal researcher and legal tech founder, Swetha has built AI products deployed inside Tier 1 firms and enterprises. She ensures GenieAI's alignment with the latest regulation and executes testing on the legal robustness of Genie output.

Reviewed by

Imad Mohammed Nazar

Legal Engineer, GenieAI

Imad Mohammed Nazar profile photo

A Skadden-trained M&A lawyer, Imad advised on cross-border transactions and contractual risk before moving into legal AI. He reviews GenieAI's output for compliance and enforceability across our 150+ supported jurisdictions, as well as facilitating external benchmarking.

Jurisdiction

England and Wales

Publisher

GenieAI

Sector

Business

Cost

Free to use

Last updated

About the Release Of Information Statement

A Release Of Information Statement is a crucial legal document that formally authorizes the sharing of personal or confidential data between parties. Under England and Wales law, this document ensures compliance with stringent data protection regulations while providing clear documentation of authorized information transfers. You need this statement whenever personal data must be shared beyond its original purpose or recipient, creating a legal framework that protects both data subjects and organizations handling the information.

When do you need this document?

You require a Release Of Information Statement in numerous professional and personal situations. Healthcare providers use these statements when sharing patient records with specialists, insurance companies, or family members. Educational institutions need them when transferring student records to other schools or providing information to parents. Employment situations often require release statements when sharing employee information with background check companies, references, or new employers. Legal professionals use these documents when sharing client information with experts, other counsel, or regulatory bodies. Government agencies and public bodies also rely on these statements when responding to Freedom of Information requests or sharing data with other departments.

Key legal considerations

Several critical legal elements must be carefully addressed in your Release Of Information Statement. The document must clearly identify the specific information being released, avoiding broad or vague descriptions that could lead to unauthorized disclosure. You must specify the exact recipient and their authority to receive the information, including any limitations on their use or further distribution. The purpose for the release must be explicitly stated and should align with lawful bases for processing under UK GDPR. Duration clauses are essential, establishing clear time limits for the authorization and preventing indefinite information sharing. The document should include provisions for withdrawal of consent where applicable, and must ensure the data subject fully understands the implications of the release. Professional confidentiality considerations may also apply, particularly in healthcare, legal, or financial contexts.

Legal requirements in England and Wales

England and Wales law imposes strict requirements on information sharing through several key pieces of legislation. Under UK GDPR, you must ensure a lawful basis exists for processing and sharing personal data, with explicit consent being the most common basis for release statements. The Data Protection Act 2018 provides additional context for special category data, including health records and criminal records, which require enhanced protection measures. When dealing with public bodies, the Freedom of Information Act 2000 may apply, creating specific obligations and exemptions for information disclosure. Common law duties of confidentiality must also be considered, particularly in professional relationships where implied duties exist. For health information, the Access to Health Records Act 1990 provides specific frameworks for medical data sharing. Your Release Of Information Statement must include clear identification of all parties, specific description of information to be shared, explicit authorization from the data subject, defined time limits, and compliance with relevant data protection principles including data minimization and purpose limitation.

Genie's Security Promise

Genie is the safest place to draft. Here's how we prioritise your privacy and security.

Your data is private:

We do not train on your data; Genie's AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

We are ISO27001 certified, so your data is secure

Organizational security:

You retain IP ownership of your documents and their information

You have full control over your data and who gets to see it