How should consent and authority be documented?¶

Record who authorised the action, their relationship to the device or account, exactly what they permitted and every limit or condition. Handing over a device is not necessarily permission to search, copy, retain or alter everything linked to it.

Define the person and the permission¶

Document identity, claimed ownership or control, and whether another person, employer or service provider also manages or uses the system. Record the explanation given, the person's response and whether permission covers access, copying, retention, disclosure, account changes or specialist examination. Include date, time, place and those present.

Use the approved organisational process, but retain the surrounding explanation: a signature alone may not establish informed scope. Note restrictions, uncertainty, withdrawal and any question about capacity or authority.

Keep consent within its boundary¶

Shared devices, workplace systems and third-party data can place material outside one person's permission. Seek legal or supervisory advice where control is unclear rather than expanding the action by assumption. Do not pressure a victim or witness to agree to something they do not understand.

If urgent safeguarding or preservation proceeds without consent, record the separate lawful basis, authority and reason delay was unsafe. Permission to access remains distinct from proof that the consenting person created or controlled particular material.