Templates and records · ISO 27701 · Clause A.1

ISO 27701 consent record template

Proof that each person said yes, what they said yes to and when, and that their withdrawal was honoured. Without a record, consent cannot be demonstrated.

In one sentence

The consent record stores, for each data subject, the moment, the channel, the purpose agreed to, the version of the information notice and any withdrawal, because GDPR article 7(1) requires the controller to be able to demonstrate consent where it is the basis for processing, and ISO/IEC 27701 includes obtaining and recording it among the controls in table A.1.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause A.1 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory record A record to be retained when processing is based on consent (GDPR art. 7(1); table A.1)
Who fills it in: The system that collects the consent Marketing, or whichever area requests it, is accountable for the wording being correct
When: At the moment it is given or withdrawn Automatically, not noted down after the fact
How long it is kept: For as long as the processing lasts and the period needed to prove it Set by the organisation according to the limitation periods for potential claims

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard asks the controller to determine when it needs consent, to obtain it and to be able to demonstrate it. It applies only to processing whose lawful basis is consent: much processing rests on a contract, a legal obligation or legitimate interest, and asking for consent that is not needed only confuses matters.

The GDPR requires consent to be freely given, specific, informed and unambiguous, withdrawing it to be as easy as giving it (art. 7(3)) and, where it is requested in a document that also covers other matters, to be clearly distinguishable (art. 7(2)).

The record must show what wording the person saw: if the clause changes, its previous version has to be kept.

Read it in context: Controls for controllers and processors, in the ISO 27701 Academy

Structure

Fields the template should include

Identification of the data subject
Purpose or purposes agreed to, each separately
Date, time and channel
Version of the information notice shown
Form of the statement: tick box, signature, affirmative action
Withdrawal: date and channel
Processing activities and systems affected by the withdrawal

Example

Example: marketing newsletter for a fictitious online shop

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Data subject	Customer no. 48213 · Heather & Co (fictitious)
Purpose	Sending a newsletter with offers (tick box separate from the purchase)
Date and channel	14 February 2026, 19:42 · Website sign-up form
Wording	Information notice v2.1
Withdrawal	3 July 2026 · Newsletter unsubscribe link · Removed from the mailing platform the same day

At the audit

Mistakes auditors commonly flag

Pre-ticked boxes, or consent bundled with acceptance of the terms and conditions.
No record is kept of which version of the clause each person accepted.
The withdrawal is noted, but the mailing provider keeps sending emails.
Consent is requested for processing that already has another lawful basis.

In Kimobox

How this record is kept in Kimobox

1Forms store the consent with its date, its channel and the version of the wording as a controlled document.
2A withdrawal launches a workflow with tasks for each affected system and their closing date.
3The audit trail records who changed what and when.

Frequently asked questions

What people ask us before getting started

Is consent needed for everything?

No. It is one of the six lawful bases in GDPR article 6. If the processing rests on a contract or on the law, there is no consent to record.

Is a log in the email marketing system enough?

If it stores who, when, for what and with which wording, and the withdrawal as well, it may be. What will not do is a list of addresses with no traceability.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring