PDPA consent form: free in Word, or sign it online
A PDPA consent form records a person's consent for an organization to collect, use and disclose their personal data. Singapore and Malaysia each have a Personal Data Protection Act that makes consent a core rule. The form says what data is collected, why, who receives it and how to withdraw consent.
Ten documents free, no card. Signed by the person giving consent.
Example filled in with sample data
The full PDPA consent form
CONSENT TO THE COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA
[Organization name], [registration number], of [address] (the "Organization"), collects personal data in line with the Personal Data Protection Act of [Singapore / Malaysia].
1. Personal Data Collected
[Full name, identification number (only where required by law), contact number, email, address, date of birth, photographs, other].
2. Purposes
The Organization will use the personal data to [provide the service requested, process payments, send service updates, comply with legal obligations, other purposes].
3. Marketing (optional)
[ ] I agree to receive marketing messages by [email / SMS / WhatsApp / phone call] about [products and services].
4. Disclosure
The Organization may disclose the personal data to [service providers, payment processors, professional advisers, government agencies where required]. [Transfer outside the country: [details and protection].]
5. Retention
The personal data will be kept for [period] or as long as needed for the purposes above and legal requirements.
6. Access, Correction and Withdrawal
I may request access to or correction of my personal data, and may withdraw my consent at any time, by contacting [data protection officer name, email, phone]. Withdrawal may affect the services the Organization can provide.
7. Declaration
I have read this notice and consent to the collection, use and disclosure of my personal data for the purposes above.
8. Security
The Organization will protect the personal data with reasonable security arrangements and will notify affected persons and the authorities of a data breach where the law requires it.
9. Updates
The Organization will ask for fresh consent before using the personal data for a purpose not listed above.
10. Contact Details of the Person
Phone: [phone] · Email: [email]. The Organization will use these details only for the purposes above and the channels I chose in clause 3.
Name
Name: [name]
Signature: ______________
Date: [date]
PARENT OR GUARDIAN (if under 18)
Name: [name]
Signature: ______________
Date: [date]
What the template includes
Organization name and registration number
Personal data collected
Purposes of use
Optional marketing consent by channel
Who receives the data and transfers abroad
Retention period
Access, correction and withdrawal of consent
Data protection officer contact
Declaration and signature
Parent or guardian line for minors
What you fill in
Field
Example
Organization
Bright Minds Tuition Centre Pte. Ltd., UEN 201912345K
Data collected
Name, phone, email, school, parent contact
Purposes
Enrolment, class updates, invoicing
Marketing
Optional, by email and WhatsApp
Disclosure
Payment processor and accountant
Retention
2 years after the last class
DPO
Grace Lim, dpo@brightminds.sg
How it gets signed
1Choose «Use this template», fill in the fields and review the full PDPA consent form.
2Send it by WhatsApp or email. The other party opens the link on their phone without an account.
3They tap the brown bar at the bottom that says «Sign as …» and draw their signature once.
4Everyone gets the signed PDF with its signature certificate. Anyone can check it at signsolu.com/verificar.
What you get once everyone signs
The signed PDF. The final PDPA consent form with every drawn signature in place.
The signature certificate. It lists each signer and the date and time of each signature.
A record you can check. The folio on the certificate opens the document history at signsolu.com/verificar.
Reminders. Turn them on and SignSolú reminds every signer who has not signed yet.
Your first ten documents are free and need no card.
What the law says
Singapore's Personal Data Protection Act 2012 sets consent, purpose and notification rules for organizations. The PDPC's overview of the PDPA is the official starting point.
Malaysia's Personal Data Protection Act 2010 also makes consent and notice core principles for commercial transactions.
Both laws let people withdraw consent and ask for access to their data. Clause 6 tells them how.
Review your purposes and retention with your own adviser. This template covers common needs and leaves room for your sector's rules.
Who needs a PDPA consent form
Tuition centres, schools and childcare collecting student and parent details.
Clinics and wellness businesses handling health information.
Gyms and studios with member records and photos.
Property agents and employers collecting identity and contact details.
Event organizers who photograph attendees.
Make consent specific
List each purpose in plain words. «For business purposes» is too broad.
Keep marketing consent separate and optional. People must be able to say no and still get the service.
Collect identity numbers only when the law requires them. Singapore restricts the collection of NRIC numbers.
Keeping proof of consent
If a regulator or customer asks, you need to show who consented and when. A signed form is the clearest proof.
Each signed PDF carries the date and time of the signature. Store it with the customer record.
When someone withdraws consent, record the date and stop the uses they withdrew. Tell your service providers to stop as well.
Common mistakes
One box for everything. Bundling marketing with service consent is a common problem.
No contact for withdrawal. Name a person or email.
Keeping data forever. Set a retention period and delete what you no longer need.
Copying another company's form. Purposes and disclosures differ. Write your own.
Collecting consent at sign-up
The best moment to collect consent is when someone signs up. Add the form to your registration step.
Send the link by WhatsApp or email with the welcome message. The person signs from the phone, and you keep the signed PDF.
For walk-in customers, show the form on a tablet at the counter. The signature works the same way.
Updating consent when purposes change
If you want to use data for a new purpose, ask for consent again. Old consent covers only the purposes it listed.
Send the updated form to existing customers and explain the change in one or two sentences.
Keep both the old and the new signed forms. They show what each person agreed to and when.
Appointing a data protection officer
Singapore's PDPA asks organizations to designate at least one person responsible for compliance. Put their contact in clause 6.
Small businesses often name the owner or office manager. What matters is that someone answers requests promptly.
Handling an access or correction request
When someone asks what data you hold, find every place it lives, from your booking system to old spreadsheets.
Reply in writing within a reasonable time, and correct mistakes the person points out. Keep a short note of each request and your answer.
Train the people who collect data at the front desk. Most problems start with a form handed over without explanation.
Before you sign
Read every clause of the PDPA consent form with the other party before anyone signs. Change what does not fit your deal.
