What is a personal data consent form?
When an organisation relies on consent to collect and use someone's personal information, it needs to tell them what it is collecting, why, who will see it and for how long, and to keep a record that they agreed. A personal data consent form does both. Clubs, charities, schools, clinics, small businesses and event organisers use one when they sign up members, clients, volunteers or attendees.
This template is written in plain language, addressed to the person ("we" and "you"). You list the information collected and the purposes it is used for; if you collect sensitive information such as health details, you describe it and why it is needed, and the form asks for explicit consent. You say who it is shared with (or that it is shared only with service providers acting on your instructions), whether it is sent to other countries, and how long it is kept. You state honestly whether consent is optional or needed for the service. The form explains the right to withdraw consent at any time and, depending on where the person lives, rights to access, correct and delete their data and to complain to a regulator. The organisation countersigns to confirm it will use the information only as described.
- Best for
- Clubs, charities, schools, clinics, coaches and small businesses collecting personal information
- Signed by
- The individual, then the organisation
- Sensitive data
- Optional section asking for explicit consent to health or other sensitive information
- Length
- 1–2 pages
When to Use a personal data consent form
- Registering members of a sports club, including medical information for emergencies
- Collecting volunteers' details and emergency contacts for a charity
- Signing up clients for coaching, therapy or wellness services
- Gathering attendee information for an event or trip
- Sharing a person's details with a governing body, partner or funder
What You Fill In
11 blanks, then the name and email of each person who signs: individual, organisation.
1 The organisation
- Organisation name*
- Organisation address
- Privacy contact (email or address)*
2 The individual
- Individual's full name*
3 The information
- Information collected*
- What it is used for*
- Sensitive information and why it is needed
- Giving this consent is* optional. If you do not give it, or withdraw it later, this will not affect anything else you receive from us · needed for the purposes described above. If you do not give it, or withdraw it later, we may not be able to provide the service those purposes relate to
4 Sharing and storage
- Who it is shared with
- Other countries it is sent to, and why
- How long it is kept*
5 Who signs
- Individual signature and date · The person whose information is collected. For a child, their parent or guardian usually gives consent.
- Organisation signature and date, job title · The organisation collecting and using the information.
What the personal data consent form Covers
- The information we collect
- Why we use it
- Who we share it with
- How long we keep it
- Your choices and rights
- Your consent
- Organisation's confirmation
Using the personal data consent form, step by step
1 Identify your organisation
Enter your name and address and a privacy contact — an email or address where people can ask questions, use their rights or withdraw consent.
2 List the information and purposes
Write the kinds of information you collect and each purpose you use it for. Be specific: consent covers only what is described. Add any sensitive information and why you need it, or leave that box empty.
3 Describe sharing and retention
Name who you share it with, any other countries it is sent to, and how long you keep it — for example "while you are a member and for 2 years after". Choose honestly whether giving consent is optional.
4 Send and keep the record
The individual signs, you countersign, and the signed PDF is filed in Files as your record of consent — with the date and time in the audit trail.
Tips Before You Send It
- Consent is not the only legal basis for using personal data, and not always the right one. Where you need the information to deliver a contract or meet a legal duty, a privacy notice may be more appropriate than a consent form.
- Collect only what you need. Every extra field is something you must protect and justify.
- Make withdrawing as easy as giving consent, and act on withdrawals promptly.
- For children, consent is usually given by a parent or guardian — check the age rules where you operate.
Sign It Online In Minutes
- Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
- Name who signs. Tick “This is me” for your own part. VergeHR builds the PDF with every signature, date box on the right line, and you can check or move anything before sending.
- Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in Files and emailed to everyone.
Personal data consent form: frequently asked questions
Does this form make my organisation GDPR-compliant?
No single form does that. This one helps you give people clear information and record their consent, which is part of what data protection laws such as the GDPR expect. You still need to handle the data securely, keep to the stated purposes and respond to requests.
Can someone withdraw their consent?
Yes, at any time, by contacting the privacy contact you name. As the form says, withdrawing does not affect how the information was used before, but from then on you must stop any use that relied on that consent.
What counts as sensitive information?
Many laws give extra protection to health, disability, racial or ethnic origin, religion, sexual orientation, biometric and genetic data, and criminal records. If you collect any of these, describe them in the sensitive information box so the form asks for explicit consent.
Is an electronic signature valid for consent?
Generally, yes. Electronic signatures are valid for ordinary documents like this in the US (ESIGN Act and UETA), the UK, the EU (eIDAS) and Canada, and VergeHR's audit trail shows when and how consent was given.