When should I use consent as the lawful basis for processing data?

Consent is appropriate when the individual has a genuine choice about whether their data is processed, and you can offer them real control. Common examples include marketing emails, newsletter sign-ups, non-essential cookies, and voluntary surveys. However, the ICO advises against relying on consent where there is a power imbalance (e.g. employer-employee), where the processing is necessary to perform a contract, or where consent cannot be freely withdrawn without detriment. In such cases, a different lawful basis (such as legitimate interests or contractual necessity) may be more appropriate.

What makes consent valid under UK GDPR?

Valid consent must be: (1) freely given — the person must have a genuine choice and not suffer any detriment for refusing; (2) specific — consent must be given for each distinct processing purpose; (3) informed — the person must know the identity of the controller, the purpose of processing, and their right to withdraw; (4) unambiguous — consent must be given by a clear affirmative act (e.g. ticking a box). Pre-ticked boxes, silence, or inactivity do not count. Bundling consent with terms and conditions is not valid.

How do I withdraw consent for data processing?

Under Article 7(3) of UK GDPR, you can withdraw consent at any time. The organisation must make withdrawal as easy as giving consent — for example, by providing an unsubscribe link in emails, or a simple email address or form. Once consent is withdrawn, the organisation must stop processing your data for that purpose. Withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

Do I need a Data Protection Officer (DPO)?

Under Article 37 of UK GDPR, you must appoint a DPO if you are a public authority, if your core activities involve regular and systematic monitoring of individuals on a large scale, or if you process special category data on a large scale. Even if not required, the ICO recommends that all organisations designate someone to take responsibility for data protection compliance. Small businesses may use an external DPO service rather than appointing one in-house.

What happens if an organisation processes my data without valid consent?

If an organisation processes your data without a valid lawful basis (including valid consent where consent is the basis relied upon), this is a breach of UK GDPR. You can lodge a complaint with the ICO, which has the power to investigate and impose fines of up to £17.5 million or 4% of annual worldwide turnover (whichever is higher). You also have the right to seek compensation through the courts for any material or non-material damage suffered as a result of the breach.

Free GDPR Data Processing Consent Form Template

A GDPR data consent form is a document used by organisations to obtain an individual's explicit consent for the processing of their personal data.

FreePDF & Word

Your data stays on your device — nothing is sent to any server.

organisation

Organisation Name (Data Controller)*

Organisation Address*

Data Protection Officer / Contact*

Provide the name and contact details of the person responsible for data protection.

data-subject

Data Subject Full Name*

Data Subject Email

processing

Categories of Personal Data to be Processed*

List all categories of personal data that will be collected and processed.

Purpose(s) of Processing*

Data Retention Period*

Will Data be Shared with Third Parties?*

rights

How to Withdraw Consent*

consent

Date of Consent*

Document Preview

DATA PROCESSING CONSENT FORM DATA CONTROLLER Organisation: [organisationName] Address: [organisationAddress] Data Protection Contact: [dpoContact] DATA SUBJECT Name: [dataSubjectName]Your data will not be shared with third parties, except where required by law. YOUR RIGHTS Under UK GDPR, you have the following rights: - Right of access — to request a copy of your personal data - Right to rectification — to request correction of inaccurate data - Right to erasure — to request deletion of your data - Right to restrict processing — to request that processing is limited - Right to data portability — to receive your data in a structured format - Right to object — to object to processing in certain circumstances - Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal To exercise any of these rights, or to withdraw your consent, please contact: [withdrawalMethod] If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. CONSENT DECLARATION I, [dataSubjectName], confirm that: 1. I have read and understood this consent form. 2. I understand the purpose(s) for which my personal data will be processed. 3. I understand the categories of personal data that will be collected. 4. I understand how long my data will be retained. 5. I understand my rights under UK GDPR, including my right to withdraw consent at any time. 6. I freely give my consent for [organisationName] to process my personal data for the purpose(s) described above. Signed: ___________________________ [dataSubjectName] Date: [consentDate]

Important Notes

Legal Disclaimer

The UK GDPR (retained EU Regulation 2016/679, as amended for the UK) governs the processing of personal data in the United Kingdom. Article 6 lists the six lawful bases for processing, of which consent (Article 6(1)(a)) is one. Article 7 sets out the conditions for valid consent: it must be freely given, specific, informed, and unambiguous. Recital 32 specifies that consent must be given by a clear affirmative act. Article 7(3) provides that consent must be as easy to withdraw as it was to give. Article 7(1) requires the data controller to be able to demonstrate that the data subject has consented. The Data Protection Act 2018 supplements UK GDPR in domestic law. The ICO is the UK's supervisory authority and can impose fines of up to £17.5 million or 4% of annual worldwide turnover for serious breaches. For special category data (Article 9), explicit consent is required. Organisations transferring data outside the UK must ensure adequate safeguards under Chapter V of UK GDPR.

This template is provided for informational purposes only and does not constitute legal advice. For complex legal matters, we recommend consulting a qualified solicitor.

Frequently Asked Questions

Related Templates

Photography Consent Form Video Filming Consent Form Medical Consent Form