Consent Log Template
An audit-ready consent log spreadsheet to record consent events, versions, timestamps, withdrawal events, and re-consent activities — aligned with GDPR and DPDP Act requirements.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- The spreadsheet captures one row per consent event. Decide first whether you log every consent or just transitions — most regulators accept transitions, but the full-events variant is friendlier under audit.
- Populate the required columns: subject identifier, consent timestamp, purpose, legal basis, consent version, source channel, user agent, IP (masked), and withdrawal timestamp.
- Version your consent notices. Every time the notice copy changes, bump the version and the log entries written under the new version will carry the new version id.
- Export the log as the evidence pack for a regulator request or an access response. The template includes a filter row for 'consents given by subject X' and 'all consents under version Y'.
- Keep the log immutable. Deleting rows retroactively is the fastest way to lose an enforcement case — append-only is the audit baseline.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Is a spreadsheet really enough for consent evidence?+
For small-volume processing, yes. The regulator asks for timestamp, purpose, version, source and the ability to show withdrawal — a well-maintained spreadsheet gives you all five. Above ~10,000 consents per month, migrate to an immutable consent record store (which is what TruePrivacy ships).
Do I need to log deemed consent too?+
Yes. PDPA deemed consent (by notification or contractual necessity) still requires evidence that the deeming conditions were met — the log captures the notice served, the time, and the channel.
What about children's consent under DPDP?+
DPDP requires verifiable parental consent for every under-18. The template includes a dedicated minor-consent column with the guardian identifier and the verification method (email code, SMS code, government ID). TruePrivacy ships a full workflow for this at /platform/consent-management.
How long should I keep consent records?+
At least as long as you process the data based on that consent — plus the limitation period for complaints. For GDPR/DPDP that's usually 5–7 years after withdrawal. For PDPA, align with your retention schedule for the related data.
Can I log consent withdrawals in the same spreadsheet?+
Yes — the template has a withdrawal-timestamp column. Alternatively, append a new row with a 'withdrawn' event type, which preserves the full history. Pick one and apply consistently.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes