Consent · free template

Lawful Basis Record

Internal one-page record of which UK GDPR Article 6 basis applies to a data collection point, decided by whom and when.

A ready-to-use consent, waivers & releases form for any team that needs demonstrable permission: 11 questions, 1 page, 2 conditional rules.

Questions: 11
Pages: 1
Layouts: classic
Conditional rules: 2
Typical time: 4 min

Preview it in the gallery

Searches this template answers

Also filed under

Data & GDPR

Live preview and test console

This is the real form. Answer it to test the flow — nothing is sent or stored.

This template runs as a straight sequence — no branching rules.

What happens after submit: nothing is stored in this preview. On your own copy, every response triggers an instant email notification and lands in your response dashboard, ready to export or forward.

Happy with it? Take a copy into your workspace — every question, rule and setting comes with it.

Who this template is for

Lawful Basis Record is built for any team that needs demonstrable permission who need to record who agreed to what, and when.

Any team that needs demonstrable permission working in consent, waivers & releases.
Teams who need to record who agreed to what, and when without writing code or paying for a custom build.
Anyone replacing consent claims you can't evidence months later with one structured record per enquiry.
Respondents are customers, patients and participants — the form asks them 11 questions across 1 screen.

Why this form is useful

It removes the cost of consent claims you can't evidence months later and turns each submission into a record your team can act on immediately.

6 questions are required, so submissions arrive complete instead of needing a follow-up email.
It pins the request to a specific date.
Conditional logic hides 2 questions until they are relevant — shorter forms convert better than long ones.
Every response is stored, searchable and exportable, so nothing depends on one person's inbox.

How to use this template

From copy to live form is a few minutes of work, and every step is reversible.

1Press “Use this template” — a fresh copy of Lawful Basis Record lands in your workspace, ready to edit.
2Rename or delete any question, and change what is required. Nothing here is fixed.
3Open Notifications and add the email addresses that should be alerted on each submission; add an auto-reply to the respondent if the form collects an email address.
4Publish it, then either share the link directly or paste the embed snippet into your site — the embedded form resizes to fit and loads no marketing or advertising trackers.
5Watch responses land in Submissions, where you can filter, label and export them to CSV or PDF.

Logic and conditions blueprint

Exactly how this form behaves as it is answered — 2 conditional rules ship with it.

Features conditional validation: if “Which lawful basis applies?” is Legitimate interests, “Legitimate interests balancing test notes” becomes mandatory before the form can be sent.
Features conditional validation: if “Does this involve special category data?” is Yes, “Article 9 condition relied on” becomes mandatory before the form can be sent.
All 2 rules are editable in the Logic tab, and the built-in checker warns about rules that contradict each other.

About this template

UK GDPR's accountability principle expects an organisation to be able to show its working, not just its outcome, and "which lawful basis applies here" is one of the most common gaps found in a data audit. This is an internal, one-page record for exactly that decision: it names the collection point (a specific form, sign-up flow or process), the Article 6 basis chosen — consent, contract, legal obligation, vital interests, public task or legitimate interests — and a short written reason for that choice. If legitimate interests is selected, it prompts for a note on the balancing test carried out, since that basis carries the most scrutiny. It records who made the decision, their role, and the date, plus a review date so the basis gets reassessed rather than left to go stale as the process changes. A field for special category data flags whether an Article 9 condition also needs recording alongside the Article 6 basis. This is not a form the public ever sees — it lives in a compliance register — but filling one out per collection point turns a vague "we probably have a basis for that" into a paper trail that holds up when someone actually asks.

What this form asks

Every question is editable — rename it, make it optional, or delete it entirely.

Lawful basis record

Collection point or process namerequired
What data is collected here?required
Which lawful basis applies?required
Reason this basis was chosenrequired
Legitimate interests balancing test notes
Does this involve special category data?required
Article 9 condition relied on
Decided byrequired
Role / job title
Date decided
Review date

11 questions in total.

How the form changes as it's filled in

This template ships with 2 conditional rules, grouped into 2 behaviours driven by 2 questions. Everything below is already set up — edit or delete any rule once the template is in your workspace.

Driven by “Which lawful basis applies?”

Makes answers required
If “Which lawful basis applies?” is Legitimate interests, “Legitimate interests balancing test notes” becomes required before the form can be submitted.

Driven by “Does this involve special category data?”

Makes answers required
If “Does this involve special category data?” is Yes, “Article 9 condition relied on” becomes required before the form can be submitted.

Set it up step by step

1
One record per collection point
Don't try to cover a whole organisation with a single basis — a website contact form and a job application will usually rely on different Article 6 bases.
2
Write the reason, not just the label
"Contract" or "consent" on its own tells an auditor nothing — the short reason field is what actually demonstrates the thinking behind the choice.
3
Always document the legitimate interests test
This is the basis regulators query most, so the balancing-test note should exist before you rely on it, not after a complaint arrives.
4
Set a genuine review date
A process that changes what it collects can silently invalidate the basis recorded for it — review dates catch that before it becomes a problem.

Mistakes to avoid

Choosing "consent" by default because it sounds safest, when contract or legal obligation is actually the correct basis and easier to rely on.
Relying on legitimate interests without ever writing down the balancing test that's supposed to support it.
Never revisiting the record, so it still describes a form or process that has since changed what data it collects.

What it pairs with

Most teams don't run this form on its own. These are the forms and systems it sits next to.

What to do with the responses

File the completed record in your data protection register against the named collection point, and set a calendar reminder for the review date.

Works in this layout

Browse classic templates

Forms that overlap this one

These pages cover the same subject ground as the lawful basis record, matched on the words people actually search for.

Privacy & compliance

This form collects health information. Keep access limited to the people who need it, turn on encrypted answers for the clinical questions, and set a retention window so records don't sit in the dashboard forever.

Frequently asked questions

Who should fill this in — legal or the team running the form?

Ideally both: the team that owns the collection point knows what data is gathered and why, and a data protection lead should sign off on the basis chosen.

Is this the same as the Marketing Opt-In Form?

No — the Marketing Opt-In Form captures a person's PECR consent to be marketed to. This record documents the organisation's internal decision about which lawful basis applies to a given collection point, marketing or otherwise.

What if two collection points use the same basis for the same reason?

You can reference an earlier record's reasoning rather than rewriting it, but still create a separate entry per collection point so the register stays accurate if one process changes later.

Does this replace a full data protection impact assessment?

No — this is a lighter, per-collection-point record. Higher-risk processing may still need a full DPIA alongside it.

Is the Lawful Basis Record template free to use?

Yes. You can preview and test Lawful Basis Record on this page without an account, and take a copy into your own HelloForms workspace on the free plan. There is nothing to install and no card required to publish it.

What does the Lawful Basis Record template ask for?

It asks 11 questions across 1 page, 6 of which are required. Every question is listed in full further down this page, and each one can be renamed, reordered, made optional or deleted after you copy the template.

Can I edit the Lawful Basis Record form after copying it?

Yes — the copy is entirely yours. Change wording, add or remove questions, switch between the classic layout, restyle it to match your brand, and set who gets notified on each submission.

How does the conditional logic in this consent, waivers & releases form work?

2 conditional rules ship with the template: Features conditional validation: if “Which lawful basis applies?” is Legitimate interests, “Legitimate interests balancing test notes” becomes mandatory before the form can be sent. Features conditional validation: if “Does this involve special category data?” is Yes, “Article 9 condition relied on” becomes mandatory before the form can be sent. All 2 rules are editable in the Logic tab, and the built-in checker warns about rules that contradict each other. All rules are editable in the Logic tab.

Where do responses to the Lawful Basis Record form go?

Submissions land in your workspace under Submissions, where you can search, filter, label and export them to CSV or PDF. You can also email a notification to your team on every submission and send the respondent an auto-reply.

Can I embed the Lawful Basis Record form on my own website?

Yes. Publish the form and paste the embed snippet into any page or share the direct link. The embedded form resizes to fit its container and loads no advertising or marketing trackers inside the iframe.

More forms teams pair with the lawful basis record.

Related categories

All Consent, Waivers & Releases templates