Updated

Guide

Data processing: consent

Guidance for solicitors and law firms on when to use consent as a basis for processing personal data.

02 Jan 2026

3 minute read

You can only use personal data if you do so “lawfully” under GDPR.

One way to do this is by getting the person's consent.

Because someone can withdraw their consent at any time, we recommend solicitors rely on one of the other lawful bases instead: 

How to get consent

Consent can be given on paper, online or verbally.

It must be clear:

that the person has freely consented
what they have consented to

Asking for consent

You should make sure consent requests are specific and separate from other terms and conditions.

The consent request must be easy to understand and include:

the name of your organisation
the name of any third-party controllers who will rely on the consent
why you want the data
what you will do with the data
how to withdraw consent at any time

You must not use pre-ticked boxes.

Recording consent

You should keep a record of consent.

Your records should include:

when and how you got consent
what you were told at the time of consent

How long consent lasts

Consent has no time limit. How long it lasts will depend on the context.

You will need to review and refresh consent. When reviewing, you should consider:

the scope of the original consent, and
the person's expectations

Parts of the UK GDPR have been changed and replaced by the Data (Use and Access) Act 2025 (DUAA).

The DUAA clarifies an organisation does not need to ask for consent again if:

a new data processing purpose is compatible with the original purpose, and
processing is made for research or archiving purposes

For example: a client gives you consent to use their data in a legal case. They then agree to let you use the same data for a training session for junior solicitors. In this scenario, you can reuse the data because you already have consent.

Parental consent

Parental consent does not expire when a child reaches 13 (the age they can consent themselves).

You may need to review the consent for children more regularly.

Learn more about children and consent.

Withdrawing consent

People must be able to withdraw consent in the same way they gave it.

For example, if they gave consent through an app, they should be able to use the same app to withdraw their consent.

As a data controller, you must make sure the withdrawal:

is free of charge
has the same level of customer service

When consent is withdrawn, you must:

stop processing the data
delete the data unless you'll rely on another lawful basis under GDPR

Different types of data and consent

Sensitive personal data

When gathering consent for sensitive (special category) personal data, you will also need to make sure you meet one of the requirements in Article 9 of the UK GDPR.

Children

Children must be at least 13 to consent. You will need to verify their age.

Children can consent using online services. Younger children will need parental consent.

Consent language must be clear and plain for children.

Third-party consent

When a person lacks the capacity to consent, someone else will need legal authority to consent for them.

For example, under a power of attorney.

Marketing

The rules around consent and marketing have changed.

For example, if you send electronic marketing or use cookies, you'll need to check that your existing permissions meet the GDPR consent rules.

Changes made by the Data (Use and Access) Act (DUAA) mean that consent is no longer required for certain cookies. These include:

those strictly necessary for provision of a service requested by the user
collecting statistical data to improve services or websites
enhancing website appearance or performance
emergency assistance

The DUAA changes to cookie permissions only apply to the UK GDPR, not to EU GDPR. You must to comply to both regimes if you operate in the UK and EU.

For all other cookies, you must:

make opt-ins clear. You cannot use pre-ticked boxes
keep consent separate from other terms and conditions
not make consent a condition of signing up to a service
keep a clear record of all consents
tell your clients how they can withdraw consent at any time
have clear consent options, specific to the data use

You will need to ask for consent again or choose a different legal basis if your existing permissions do not meet these new standards or are not well documented.

For more information, read the ICO’s guide to lawful basis.