Personal Data Consent Form

About this template

When to use it

A one-page Personal Data Consent Form built on the four things Korea’s Personal Information Protection Act requires you to tell a data subject before consent counts: the purpose of collection and use, the items collected, the retention and use period, and the right to refuse together with what follows from refusing. Those four sit across three numbered sections. The header cells read Collecting organization / Privacy officer / Contact point / Consent form No., sampled as ○○○○ Co., Ltd., “Kim Seo-yeon, Corporate Support Team” and PI-2026-0087. The example is filled out for a hiring process; change the values, keep the structure.

Filling order

1. The header table first. The contact point must be a channel that answers, because it is where a withdrawal request arrives.
2. 1. Purpose of collection and use, and the items collected — one purpose line, one required-items line, one optional-items line.
3. 2. Retention and use period, and destruction — the period, the destruction method and deadline, and the statutory-retention exception.
4. 3. Right to refuse consent and the consequences — the right, the consequence of refusing the required items, then the tick line: Required □ I consent □ I do not consent Optional □ I consent □ I do not consent.
5. At the foot, the data subject writes their name and date of birth and signs.

Required and optional must stay apart

Splitting the items is the point of this form. Required items are the minimum without which the stated purpose cannot be achieved; everything else is optional. You cannot refuse the service, or the application, because someone declined the optional items — which is why the tick line in section 3 carries two separate pairs of boxes. Merge them into one all-or-nothing consent and what you collected may not stand up later.

Write the period as an event

Section 2 reads “from the date of consent until 6 months after the hiring process ends”. A period anchored to an event is one the data subject can understand; a period written as indefinite, or as whatever the company decides, tells them nothing and does not discharge the requirement. Once the period ends the data must be destroyed without delay — the file commits to within 5 days, by a method that cannot be reversed. Where another statute imposes a retention duty, keep the data that long and say so.

The four cells restate sections 1 and 2

The Key metrics table reads 6, 3, 6 months and 5 days, labeled required items, optional items, retention period and destruction deadline. Add or drop an item above and the count changes with it. One wording note: the heading over the signature block is the generic Confirmation and approval — on a consent form what is given is consent, not approval, so it reads better retitled. Where the data subject is under 14, consent from a legal representative is needed separately, so add a line for that signature.

Reusing it for another purpose

Keep the structure and change the values. When the purpose changes the required items change with it: for sending a prize you need name, phone and address, and usually not a date of birth; for logging an inquiry, contact details and the substance of the inquiry, with no reason to ask about education or work history. Narrow the purpose first, then keep only the items that purpose needs — required and optional then separate themselves. Two purposes means two sections and two consents.

After you collect it

• Give the data subject a copy if they ask. Signed forms are routinely filed and never returned.
• Store the forms as what they are — records containing personal data. Paper under lock, files behind restricted access, destroyed alongside the data when the section 2 period expires.
• Do not accept a form without a name, signature and date; you may later have to prove consent was given.
• Provision to a third party or outsourcing the processing needs more than this form. The recipient, the purpose, the items provided and the retention period are notified separately and consented to separately.
• This template is a general form and is not legal advice. Where you handle sensitive data or unique identifiers, have it reviewed before use.