Skip to ContentSkip to Navigation
Digital Competence Centre
your one-stop for reserach IT and data
Digital Competence Centre Privacy & Data Protection GDPR & Research

Informed Consent

If your project involves human data subjects, it is important that you have a legal basis for using their data. Consent is one of the legal grounds for processing personal data for scientific research. It’s a crucial ethical principle to ensure that individuals are fully aware of the nature of the research, its potential risks and benefits, and their rights before they decide to participate.

When you use consent as a legal basis for your research, you need to be able to demonstrate that the participants have consented to the processing of their data. One of the ways in which you can do this is by asking them to sign a consent form.

Requirements for consent

When asking for consent, you should make sure that it is:

  • Freely given: Consent is not valid when the data subject has no real choice, feels compelled or pressured to consent, or will endure negative consequences if they refuse or withdraw consent. Participants must also have the legal and mental capacity to give consent. This means they are of legal age (or have appropriate parental/guardian consent) and have the cognitive ability to understand the information and make a decision.
  • Specific: The purpose for which consent is being sought must be clearly defined. The more specific and detailed you can be about how the data will be used, the better.
  • Informed: Providing information to the participants is essential to their ability to make informed decisions. Researchers must provide participants with clear, comprehensive, and understandable information about the research. This includes the purpose of the study, procedures involved, potential risks and benefits, expected duration, and any alternatives to participation. Researchers should also disclose any potential conflicts of interest, funding sources, or affiliations that could influence the participant's decision to participate.
  • Unambiguous: The wishes of the participants to agree to the processing of their data must be clear. Unambiguous consent means that an individual's agreement or permission is clear, explicit, and easily understandable. It ensures that there is no room for confusion or misinterpretation.
What to include in a consent form?

At least the following information should be included in your consent form:

  • The identification of the data controller (usually the researcher), joint-controllers (if the case) and, the contact details of the Data Protection Officer
  • The description of the purpose(s) of the data processing (e.g. analysis, developing a new treatment)
  • The description of the subject’s rights, in particular, the right and the procedure to withdraw consent and the right to lodge a complaint with a supervisory authority. Participants have the right to withdraw from the study at any time without facing negative consequences.
  • Information as to whether data will be shared with or transferred to third parties and for what purposes
  • How long the data will be retained before it is destroyed
  • Whether the participant agrees or not with the reuse of their data at the end of the research project

Be clear and transparent in your communication

All the information provided to the participants must be presented in a transparent and easily accessible way, using clear and understandable language. Participants must be capable of understanding the information provided to them. Researchers should use plain language and avoid technical jargon.

If participants have questions, researchers should address them adequately. There are different ways you can inform participants about the manner in which you or possibly others are going to process their data. Examples of methods that are commonly used are privacy statements/notices and information on the project’s web page.

In long-term studies, researchers should seek to obtain ongoing informed consent, especially if there are any changes to the research protocol or if new risks emerge.

Informing indirectly

In most studies, it is possible to inform data subjects directly about the processing of their personal data. However, there are also studies in which informing the subject directly is not as straightforward (e.g. in social media research).

The DCC has developed a guide on the steps you should follow in these situations and what information you should make publicly available to inform your data subjects indirectly.

Last modified:04 October 2023 1.09 p.m.