Consent in research – ethics & privacy (GDPR)

To obtain valuable data & insights, research often involves working with human participants and specific methods and tools to obtain information such as surveys, questionnaires, interviews, standardised tests, direct observations, ethnography, recording experiments with volunteers, physical interventions of all sorts,….

Such human participation requires evidence of the voluntary, free, and informed consent of the participants prior to their participation in research. When the involvement of humans or the participation of humans in research also means that their personal data will be collected and processed, a consent to process that personal data might also be necessary in light of the GDPR. The consent to participate in research and the potential consent to legitimately process personal data are somewhat different and should be addressed separately.

Consent to participate in research (ethical consent)

Informed consent, whether given in writing (most often) or given orally, is part of most research projects with human participants. As a researcher you are not only responsible for obtaining this voluntary participation of humans, but you are also responsible for documenting these consents and for storing them in a secure place. To be able to give consent as a participant, researchers must inform their participants as consciously and deliberately as possible.

Obtaining  informed  consent,  however,  does  not  in  itself guarantee  ethical research. In some research settings, this very act and the aim of safeguarding participants’ rights and well-being in the research setting may place them at risk of harm in their social context (rather than affording them protection). There may also be  situations in  which standard  procedures  for obtaining  written  informed  consent are culturally or contextually inappropriate to the participants. In such cases, you should think about how to obtain and document consent by other means (e.g. orally).

When your research needs ethical consent from your participants, but you do not collect any personal data, you can use the template ‘ICF_ethics_EN’ for (ethical) consent that is attached at the bottom of this research tip. Of course, this template will need some tailoring to make it applicable to your research.

Consent to participate in research and to process personal data (Consent under GDPR)

Whenever personal data is gathered in research, Privacy legislation applies. Whenever a research is set up by a European institution or researcher, or when the data subjects are European citizens, this law applies. Be aware that ‘personal data’ covers a lot. The GDPR includes six legal grounds for the lawful gathering & processing of personal data, three of which are most often used for scientific research: public interest, legitimate interest, and consent.

If consent is used as a legal ground to process personal data, this consent from your participants must meet the standards of the GDPR. This requires consent to be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the subject’s agreement to the processing of their personal data. This may take the form of a written statement, which may be collected by electronic means, or an oral statement.

If another legal ground is used to process personal data in your research (so no consent for the processing of personal data, but e.g. public interest), this must be clearly stated in your information sheet. Please make it clear and understandable for participants that the ethical consent is not the same as the GDPR consent.

All of this is a legal obligation and should be prepared before the actual data collection.

Informing and obtaining consent – when you are also collecting/processing personal data

Whenever the research entails the collection/processing of personal data (with consent as legal ground), one form and information letter may cover both the ethical and the legal consent. It is, however, important that the information letter and consent form fully cover all aspects of the data collection and protection, including what will happen with the data afterwards and how it (potentially) will be disseminated.

After a consent form is signed by a research participant, you cannot deviate from the principles on which the participants have agreed upon (unless participants re-consent – if possible).

To make sure you have covered all necessary aspects, researchers may use the template ‘ICF_ethics_GDPR_EN’ that is attached at the bottom of this research tip. This template is a single document, including both an information and consent (ethical & GDPR) form. Of course, this template will need some tailoring to make it applicable to your research.

Bear in mind, if your research needs to be approved by the medical ethics committee, you must use their templates!



More tips

Translated tip

Last modified May 18, 2022, 8:43 a.m.