Power Automate workflow · Compliance

PDPA consent capture with purpose, retention date and evidence

Capture consent with Acrobat Sign or a form, store purpose and retention date as metadata, and flag records due for disposal.

TriggerAcrobat Sign completion (consent form) or Microsoft Forms response
ConnectorsAdobe Acrobat Sign · SharePoint · Microsoft Teams
CategoryCompliance

The problem

Consent forms sit in filing cabinets; nobody knows what each person agreed to or when the data should be deleted.

The outcome

Every consent record has purpose, date and retention end date, and disposal reviews run automatically.

Before you start

  • A consent library with columns: Data Subject, Purpose (choice), Consent Date, Retention Until, Withdrawn (yes/no).

Build it step by step

  1. Capture — The data subject signs the consent notice (English and Bahasa Malaysia versions, as PDPA requires notices in both).
  2. Store with metadata — Save the signed PDF and set Retention Until based on purpose (e.g. 7 years after relationship ends).
    Expression / setting
    addToTime(utcNow(), 7, 'Year')
  3. Withdrawal — A form lets data subjects withdraw consent; the flow sets Withdrawn = Yes and notifies the data owner.
  4. Disposal review — A monthly flow lists records past Retention Until and sends them to the DPO for disposal approval.
  5. Evidence — Keep the Acrobat Sign audit report as proof of when and how consent was given.

Connector action names are shown as they appear in Power Automate at the time of writing; Microsoft and Adobe occasionally rename actions or add new versions.

Error handling

  • Don't auto-delete — PDPA disposal should be reviewed; other laws may require longer retention.

Licensing

  • Standard connectors + Acrobat Sign.

Variations

  • Use Microsoft Purview retention labels for automated retention and disposition review.

Common in: Healthcare · Banking · Education · Retail