Drafting a clear and legally valid consent form is a crucial step for any organization that wishes to comply with the General Data Protection Law (Law No. 13.709/2018). 

In general terms, the term ensures that the data subject is fully aware of how their information will be used, and serves as concrete evidence of respect for privacy and the legal principles governing data processing in Brazil.

Often, without realizing it, we provide our personal information when filling out a registration form in an online store, accepting the terms of a mobile application, scheduling a medical appointment, or even entering a building that requires registration with an ID and photograph. 

Everyday life is full of situations in which data is collected, stored, and sometimes shared without the owner fully understanding how this happens or for what purpose.

It is in this context that the consent form becomes indispensable because it represents an attempt to rebalance this relationship, returning control over the data subject to them. 

Therefore, it must be constructed in a way that is accessible, transparent, and appropriate to the reality of the activity carried out by the organization.

In this article, we explain the essential requirements for creating a consent form that meets legal parameters and best practices recommended by the National Data Protection Authority (ANPD). 

The analysis is deepened with real-world examples and directly connected to the professional experiences gained from the postgraduate courses in Digital Law, Data, and Artificial Intelligence at IDP, a nationally recognized program that combines academic rigor, practical application, and an interdisciplinary approach focused on the contemporary challenges of data protection.

To begin: what is a consent form and when should you use it?

The consent form is the way in which a person explicitly and consciously authorizes the use of their personal data for a specific purpose. 

This is one of the ten legal bases provided for in the General Data Protection Law (LGPD), specifically in article 7, I. 

Consent is neither generic nor presumed; it must be clear, direct, and linked to specific purposes that the data subject can easily understand.

Its use is essential in contexts where there is no other legal basis to justify data processing, such as compliance with a legal obligation, the performance of a contract, or the legitimate interest of the controller. 

Furthermore, the LGPD (Brazilian General Data Protection Law) mandates consent as a compulsory requirement in more sensitive cases, such as the processing of children's data or sensitive personal data. 

These latter include information about health, religious beliefs, sexual orientation, racial or ethnic origin, and biometric data, for example. Furthermore, in such cases, consent must be clearly defined, specific, and address each purpose separately.

Effective action in these cases requires technical knowledge and ethical sensitivity, topics extensively covered in IDP courses, in subjects such as "Elements of Data Protection and the Framework for Applying the LGPD" and "Compliance Practices in the LGPD". 

In these classes, students discuss real-life cases and learn to differentiate between situations where consent is necessary and those where other legal bases are more appropriate, such as contract performance or the legitimate interest of the data controller.

Legal requirements for valid consent

• For consent to be valid, it must meet objective criteria: 
• The document must specify the purpose of the processing; 
• Use clear and accessible language; 
• allow revocation at any time; 
• and to unequivocally record the holder's consent. 

Furthermore, consent must be highlighted when sensitive data is involved (art. 11, I), such as health information, religious beliefs, or biometric data.

Although there is no mandatory template, the structure of a consent form should be functional, clear, and compatible with the context of the activity being carried out. 

However, some elements are indispensable: identification of the controller, description of the data collected, purposes of the processing, any sharing with third parties, security measures adopted, rights of the data subject, means of revocation, and customer service channel.

I need to draft a consent form, what now?

Imagine that a healthcare clinic, concerned with meeting the requirements of the LGPD (Brazilian General Data Protection Law) and establishing a transparent relationship with its patients, decides to create a consent form. 

The first step is to understand the nature of the data that will be collected during the consultation: information such as name, CPF (Brazilian tax identification number), address, telephone number, medical history, laboratory tests, and data about health insurance or plans.

Next, the clinic team needs to reflect: why is this data being requested? How will it be used? With whom might it eventually be shared? And for how long will it be stored? These questions help to structure the agreement in an honest and objective way.

Furthermore, the clinic should consider that sensitive data (such as medical history) requires extra care. 

The data subject must clearly understand that they are authorizing the use of this information exclusively for the purposes of care, diagnosis, billing, and referral to ancillary services.

When drafting the consent form, the language used should be direct and understandable. Avoid technical jargon or confusing clauses. The idea is to ensure that any patient, upon reading the document, knows exactly what they are authorizing. 

It is also essential to inform them that this consent can be revoked at any time, and to indicate the contact channel for doing so.

Having completed this reflective process, the organization will be ready to develop a document that goes beyond mere legal compliance. In this context, the informed consent form becomes a tool for respect and trust in the relationship between the clinic and the patient.

Let's take an example: 

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I, [patient's full name], registered under CPF number [xxx.xxx.xxx-xx], residing at [full address], declare that, freely, informedly and unequivocally, I authorize [clinic name], registered under CNPJ number [xx.xxx.xxx/0001-xx], with headquarters at [clinic address], hereinafter referred to as "Controller", to process my personal data and sensitive personal data, in accordance with the General Data Protection Law (Law No. 13.709/2018), for the following purposes:

• Registration and identification as a patient at the clinic;
• Scheduling appointments, exams, and procedures;
• Issuance of electronic medical records and registration of clinical history;
• Communication with health insurance providers for billing purposes;
• Forwarding information to laboratories, imaging clinics, and auxiliary services related to patient care;
• Compliance with legal and regulatory requirements applicable to the healthcare sector.

Data processed: full name, date of birth, CPF (Brazilian tax identification number), RG (Brazilian identity card number), address, telephone number, email, health insurance information, insurance card number, medical history, clinical data, exams, prescriptions, and reports.

I also declare that I am aware that:

1. I have the right to access, correct, update, delete, anonymize, or request the portability of my data, as provided for in articles 18 et seq. of the LGPD (Brazilian General Data Protection Law).
2. I can revoke this consent at any time by sending a formal request to the email address [contato@clinica.com];
3. The data will be stored for the period necessary to provide the services and comply with legal and regulatory obligations, including for the purposes of mandatory retention of medical records;
4. The Controller undertakes to adopt all technical and administrative security measures to protect my personal data against unauthorized access, loss, destruction, or any form of improper processing.

[Location], [Date]

Signature of the account holder: ____________________________________________

Each term is different. Remember that!

Of course, each field of work requires specific care. For example, consider this:

In healthcare, health regulations and the duty of confidentiality impose a more rigorous standard of confidentiality. 

In e-commerce, obligations are linked to marketing, tracking consumer preferences, and the right to opt out. 

In offices and service companies, the focus should be on the contractual purpose and the means of contact used.

In this scenario, those who specialize in data protection, digital law, and information governance find a fertile field of opportunities. It is a continuously expanding area with a high demand for qualified professionals. 

Therefore, investing in solid training is more than just a differentiator — it's a strategic choice. 

IDP 's postgraduate program in Digital Law, Data, and Artificial Intelligence offers precisely this foundation: a comprehensive program with excellent professors, an interactive methodology, and a focus on the main challenges of contemporary reality.

In a world where data has become the new oil, understanding the rules of the game and knowing how to apply them responsibly is what differentiates the professional who merely follows the market from the one who leads the transformations.