Templates and records · ISO 27701 · Clause A.1
ISO 27701 consent record template
Proof that each person said yes, what they said yes to and when, and that their withdrawal was honoured. Without a record, consent cannot be demonstrated.
In one sentence
The consent record stores, for each data subject, the moment, the channel, the purpose agreed to, the version of the information notice and any withdrawal, because GDPR article 7(1) requires the controller to be able to demonstrate consent where it is the basis for processing, and ISO/IEC 27701 includes obtaining and recording it among the controls in table A.1.
- Where the standard requires it
- ISO 27701 · Clause A.1 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
- Type of information
- Mandatory record A record to be retained when processing is based on consent (GDPR art. 7(1); table A.1)
- Who fills it in
- The system that collects the consent Marketing, or whichever area requests it, is accountable for the wording being correct
- When
- At the moment it is given or withdrawn Automatically, not noted down after the fact
- How long it is kept
- For as long as the processing lasts and the period needed to prove it Set by the organisation according to the limitation periods for potential claims
What the standard requires
What ISO 27701 demands and what it leaves to your judgement
The standard asks the controller to determine when it needs consent, to obtain it and to be able to demonstrate it. It applies only to processing whose lawful basis is consent: much processing rests on a contract, a legal obligation or legitimate interest, and asking for consent that is not needed only confuses matters.
The GDPR requires consent to be freely given, specific, informed and unambiguous, withdrawing it to be as easy as giving it (art. 7(3)) and, where it is requested in a document that also covers other matters, to be clearly distinguishable (art. 7(2)).
The record must show what wording the person saw: if the clause changes, its previous version has to be kept.
Structure
Fields the template should include
- Identification of the data subject
- Purpose or purposes agreed to, each separately
- Date, time and channel
- Version of the information notice shown
- Form of the statement: tick box, signature, affirmative action
- Withdrawal: date and channel
- Processing activities and systems affected by the withdrawal
Example
Example: marketing newsletter for a fictitious online shop
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Data subject | Customer no. 48213 · Heather & Co (fictitious) |
| Purpose | Sending a newsletter with offers (tick box separate from the purchase) |
| Date and channel | 14 February 2026, 19:42 · Website sign-up form |
| Wording | Information notice v2.1 |
| Withdrawal | 3 July 2026 · Newsletter unsubscribe link · Removed from the mailing platform the same day |
At the audit
Mistakes auditors commonly flag
- Pre-ticked boxes, or consent bundled with acceptance of the terms and conditions.
- No record is kept of which version of the clause each person accepted.
- The withdrawal is noted, but the mailing provider keeps sending emails.
- Consent is requested for processing that already has another lawful basis.
In Kimobox
How this record is kept in Kimobox
- 1Forms store the consent with its date, its channel and the version of the wording as a controlled document.
- 2A withdrawal launches a workflow with tasks for each affected system and their closing date.
- 3The audit trail records who changed what and when.
Frequently asked questions
What people ask us before getting started
Is consent needed for everything?
No. It is one of the six lawful bases in GDPR article 6. If the processing rests on a contract or on the law, there is no consent to record.
Is a log in the email marketing system enough?
If it stores who, when, for what and with which wording, and the withdrawal as well, it may be. What will not do is a list of addresses with no traceability.
Keep your ISO 27701 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Controls for controllers and processors
Annex A gathers the PIMS reference controls for controllers and processors; Annex B, also normative…
ISO 27701 record of processing activities template
What the record of processing activities must contain in an ISO 27701 PIMS and under GDPR article 30…
ISO 27701 personal data inventory template
How to build a personal data inventory for an ISO 27701 PIMS: where the data live, in which systems, who has…
ISO 27701 privacy risk assessment template
How to document an ISO 27701 privacy risk assessment: criteria, risk to individuals, likelihood, impact…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016; applicable since 25 May 2018
- ISO/IEC 27701:2025 — Privacy information management systems. Requirements and guidance ISO/IEC · Second edition, October 2025