How to build a POPIA-compliant consent form
A plain-English guide for South African schools, clubs and organisations collecting signed consent: what to include, why a typed name isn't a signature, and how to do it digitally.
What every consent form needs
A clear, specific purpose
State exactly what you're asking consent for, such as a school outing, photo use, or medical treatment authorisation, not a vague "I agree to the terms". Vague consent is weak consent.
Who is consenting, and for whom
If a parent is consenting on behalf of a child, or a next-of-kin on behalf of someone else, capture that relationship explicitly, not just a name.
A real signature, not a checkbox
A drawn signature, captured on the respondent's own phone, with a timestamp and device details recorded alongside it, is far stronger evidence of genuine consent than a checkbox someone could tick on another person's behalf.
A record you can produce later
Keep the signed form, the consent timestamp, and enough context to show what the person actually agreed to, not just that "someone" submitted a form.
Paper vs. a digital consent form
Paper forms get lost, are hard to search, and a scanned signature at the bottom of a photocopied page is easy to dispute. A digital form that captures a finger-drawn signature plus the respondent's IP address, device and timestamp gives you a proper audit trail, the same kind of record a legal or insurance claim would actually ask for, without printing, scanning, or filing anything.
Common questions
Is a digital signature legally valid in South Africa?
Under the Electronic Communications and Transactions Act (ECTA), most everyday consent and indemnity agreements can be signed electronically. A drawn signature captured with a timestamp, IP address and device details is generally strong evidence of consent for typical school, club and event forms. A small category of documents (certain wills, property transfers, some financial instruments) legally require a wet-ink signature. If you're unsure whether your specific document qualifies, get your own legal advice.
What’s the difference between a checkbox and a signature?
A checkbox ("I agree to the terms") is easy to add but weak evidence, since anyone could tick it on someone else's behalf. A drawn signature, captured with a finger or stylus and stored as an image alongside consent metadata, is far harder to dispute and is what most schools and clubs actually mean when they say "please sign the form".
What does POPIA actually require from my organisation?
The Protection of Personal Information Act requires you to collect personal information only for a specific, lawful purpose, tell people what you're collecting and why, keep it secure, and not keep it longer than necessary. For a consent form, that means: a clear statement of what you're collecting and why, an actual consent mechanism (not just a submit button), and a reasonable process for someone to ask you to correct or delete their information later.
What should an indemnity/consent form actually include?
At minimum: who is consenting and for whom (e.g. a parent on behalf of a child), what activity or processing they're consenting to, an explicit consent statement (not just an implied "by submitting you agree"), a real signature, and a record of when and how it was captured. For anything safety-related (sports, outings, medical), also capture emergency contact details and any relevant medical information.
Do I need to keep signed forms forever?
No. POPIA specifically discourages keeping personal information longer than you need it for. Decide a retention period that makes sense for your context (e.g. the current season, or the statutory period for the type of claim the form protects against), and have a plan to delete records after that. Digital records make this much easier than a filing cabinet of paper forms.
Ready to build your first form?
Free for the first 14 days, thereafter R299 per month.
Get started free