A signed consent form is a short document that says what the person agrees to, who they are, and when they agreed. To make it hold up, name the exact purpose, give a way to say no or withdraw later, add a date, collect a signature from the right person, and give them a copy. The sections below show what each common type must say.
This is general information, not legal advice. Consent rules differ by country and by sector, so check the rules that apply to you or ask a lawyer.
The five types of consent form and what each must say
Photo and media release. There is no single official standard, so draft it plainly. State where the images will appear (website, brochure, social media), for how long, and whether the person is named. Add a line saying they can ask you to stop using their image for future uses.
Medical or treatment consent. NHS guidance on consent to treatment says consent must be voluntary and informed, and the person must have capacity to decide. Consent can be given verbally, in writing (for example, signing a consent form for surgery) or non-verbally. A form records the decision. It does not replace the talk about risks.
Parental consent for a minor. In England, the NHS says people aged 16 or over can consent to their own treatment, and other countries set different ages. For schools and clubs, name the child, the activity, and the adult who signs and how they relate to the child.
Research participation. In the US, 45 CFR 46.116 lists the elements. They include the purposes and expected duration of the research, a description of the procedures, how far confidentiality will be kept, and a statement that taking part is voluntary. Then 45 CFR 46.117 requires the form to be signed (including in an electronic format) and a written copy to go to the person who signed.
Data processing consent. The UK ICO explains that valid consent under the UK GDPR must be freely given, specific, informed and unambiguous, and it quotes Article 4(11) for that test and Article 7 for the conditions on records, withdrawal and separate requests. The EU GDPR carries the same articles, so read the official text if you handle EU data.
Clause by clause: what goes in the form
Not every row applies to every form.
| Clause | What to write | Example (fictional) |
|---|---|---|
| Parties | Full name of the person, and of the organisation asking | Asha Verma agrees to let Lakeside Studio use her photos |
| Purpose | One specific use, not "any purpose" | Portfolio page and two print brochures |
| Scope | What data, images or procedures are covered | Photos taken on 12 March at the studio |
| Duration | Start date and an end date or review date | 24 months from signing |
| Voluntary | A statement that saying no has no penalty | Declining will not affect the booking |
| Withdrawal | How to withdraw, and what happens next | Email the studio; removal from future use within 14 days |
| Who sees it | Who receives the data or images | Studio staff and the printer only |
| Signer | Printed name, signature, date | Signed 14 March 2027 |
| Guardian | Name, relationship and signature if the person is a minor | Parent or legal guardian signs |
| Copy | A statement that the signer gets a copy | Signed PDF emailed to Asha |
Copyable checklist before you send
- I named one purpose, in plain words.
- I listed what is covered and what is not.
- I set a duration or a review date.
- I wrote how to withdraw and who to contact.
- I added a date line next to the signature.
- I added a guardian block if the person may be a minor.
- I will send the signer a copy.
- I know where the signed file will be stored.
Common mistakes and the fix for each
Vague scope. "Use my photos for marketing" can mean anything. Fix it by listing channels, dates and the exact material.
No withdrawal clause. Under the ICO guidance, data consent must be easy to withdraw. Fix it by naming an email address and a response time you can keep.
No date. An undated form cannot show when the person agreed. Fix it by adding a date field beside every signature.
Not signed by a guardian. A child's signature alone may not be enough. Fix it by adding a guardian block and checking the age rule in your country.
No copy to the signer. The US research rule above requires one, and it is good practice everywhere. Fix it by sending the signed file to every signer.
How to get it signed electronically and keep the proof
In the US, the ESIGN Act says a signature or contract cannot be denied legal effect solely because it is in electronic form. Other countries differ, so confirm yours.
- Turn the form into a PDF with the date and signature fields in place.
- Send each signer their own link so each signature is tied to one email address.
- Ask for the guardian signature when the subject is a minor.
- Keep the signed PDF and the audit trail together. A good audit trail shows who signed, when, and from which email.
- Send the signed copy to the signer and store yours somewhere access is limited.
A ready consent form template gives you the clauses above to edit. To send it, sign a PDF online with fields for each signer. DulySigned can do this: signers need no account, each gets a 6-digit email code, and everyone receives the signed PDF with an audit certificate. It creates simple electronic signatures only. It does not verify who the person is, and it is not Aadhaar eSign or a DSC.
When you still need a wet signature or a witness
Some documents need ink, a witness or a notary. In England and Wales, the Law Commission says a deed must be signed in the physical presence of a witness, even where signer and witness use electronic signatures. Schools, hospitals and ethics boards may set their own rules, so ask the body that receives the form first.
FAQ
Is a digital consent form valid?
Often yes. Many countries accept electronic signatures for ordinary consent, but some documents and sectors have exceptions. Check local rules, and the rules of any regulator or ethics board that applies to you.
How long should I keep a signed consent form?
It depends on the sector and country. Medical, school and research records often have their own retention rules, so ask your regulator or ethics board. For data consent, keep the record for as long as you rely on that consent, because you must be able to show it.
Can consent be withdrawn?
Yes, for data processing and research. The US research rule says a participant may stop at any time. Withdrawal usually applies to future use, so say what happens to past use.
Who signs a consent form for a child?
Usually a parent or legal guardian. In England, 1 person with parental responsibility is enough for treatment. Check the age and rules where you live.