Data & Privacy: templates and forms
6 forms available to fill out or download.
Consent to being photographed and to the use of the image
Needed by photographers, agencies, schools and event organisers — the image of an identifiable person is personal data, and using it for advertising or publication requires consent. The declaration sets out where and for how long the material will be used, whether there is a fee, and whether the person will be named. For a child it is signed by a parent.
Consent to the processing of personal data
Consent is only one of the grounds for processing, and the most fragile one: it has to be specific, informed and capable of being withdrawn, and silence or a pre-ticked box is not consent. So this declaration lists the purposes separately and states the right to withdraw expressly. If you process data under a contract or under a statutory duty, you do not need consent and should not ask for it.
Request for erasure of personal data
The right to be forgotten under Article 17 of the General Data Protection Regulation. It is not unconditional: data the organisation keeps by law, for accounting, or to defend a legal claim stay. So the request names exactly which data and on what ground, and asks for a written answer — including when the answer is a refusal, so that there is something to appeal against.
Complaint to the Commission for Personal Data Protection
The step to take when a controller has not answered your request or has refused it without good reason. The order is the same as in consumer disputes: first a request to the organisation, then a complaint to the commission with a copy of the correspondence attached. A complaint with no prior request is usually sent back, because there is no refusal to examine.
Subject access request
The right under Article 15 of the General Data Protection Regulation: to find out what data an organisation holds about you, where it got them, who it gives them to and how long it keeps them. The request is free and goes straight to the controller, not to the regulator. Word it specifically — a blanket request for everything usually comes back with the least that will do.
Objection to processing for direct marketing
Marketing calls, messages and letters stop on an objection under Article 21 of the General Data Protection Regulation. Unlike the other rights, there is no balancing here and no exceptions: on an objection to direct marketing, processing for that purpose ends. The document lists the channels separately, because unsubscribing from the newsletter does not stop the phone calls.