Free letter of consent template
A free letter of consent template for Kenya. Consent works when it is given for a stated purpose: section 30(1) of the Data Protection Act permits processing where the data subject consents to it for one or more SPECIFIED purposes. So this letter names the purpose, what is covered, who may rely on it, how long it lasts and how to withdraw it — a letter consenting to "the use of my information" specifies nothing.
What you still need to do
- Name the purpose. Section 30(1)(a) of the Data Protection Act speaks of consent for one or more SPECIFIED purposes — a consent to "the use of my information" specifies nothing.
- List exactly what the consent covers, and where it is to be obtained from someone other than you, name that source — section 28(2)(c) is what permits collection from another source.
- Give it an end date, and say in writing how it can be withdrawn and to whom.
- Ask the organisation what they require before you sign. Travel consent for a child is often required to be commissioned, and requirements differ between airlines and borders.
- If you are consenting for someone else, state the capacity and the authority on the face of the letter.
- A letter of consent cannot make something lawful that is not. Dealings with land, the care arrangements for a child, and medical decisions for a person who cannot decide each have their own law, and a letter is not a substitute for it.
Why each clause is here
Every clause in this document is drawn from the provision named beside it, and the wording of each provision was read in the Act itself. Where the law fixes something a document cannot change, this is where it says so.
A consent has to be traceable to a person who was entitled to give it. Where someone consents for another — a parent for a child, a guardian for a person who cannot decide — the capacity and the authority have to be on the face of the letter, because the organisation relying on it has to know whose consent it is holding.
🔴 This is the clause the whole letter turns on. Section 30(1)(a) of the Data Protection Act allows processing where the data subject consents to the processing for one or more SPECIFIED purposes — the word "specified" is doing the work. Clause 2 names the purpose and shuts the door on others. Note also that consent is only one of the routes in section 30(1): the Act also permits processing where it is necessary for a contract, a legal obligation, vital interests, a public-interest task or official authority. If one of those applies, the organisation does not need this letter at all.
Section 28(1) of the Data Protection Act requires a data controller or processor to collect personal data DIRECTLY from the data subject. Section 28(2) lists when it may be collected indirectly, and paragraph (c) is the one this letter supplies: where the data subject has consented to the collection from another source. 🔑 That is why clause 5 exists and why it names the source — a general consent does not satisfy section 28(2)(c) for a collection the person never knew was happening.
Consent that cannot be withdrawn is not really consent, and clause 7 says how to do it and where to send it — a right nobody can exercise is a right on paper only. The saving for what was already done is ordinary and fair: it protects the organisation that acted properly while the consent stood, without letting it carry on afterwards. Where consent under section 30(1)(a) is the only basis for the processing, withdrawing it removes that basis for anything done after.
No Act we hold requires a letter of consent to be witnessed or commissioned. The note is here because immigration authorities, airlines and schools frequently do require it for travel consent — and a consent letter refused at a counter is worse than no letter, because by then the trip is under way.
The provisions, in the Act’s own words
Spacing is normalised for reading. Every word is the Act’s.
A data controller or data processor shall not process personal data, unless— (a) the data subject consents to the processing for one or more specified purposes; or (b) the processing is necessary—
A data controller or data processor shall collect personal data directly from the data subject.
the data subject has consented to the collection from another source;