Informed Consent
Processing personal data, i.e. data about human beings, see General Data Protection Regulation (GDPR), requires a legal ground. One of the most common legal grounds used in scientific research is asking participants for their consent.
Consent as a legal ground
In order for consent to count as a valid legal basis, several conditions must be met.
- Participants must be informed about the processing of their personal data before the processing takes place.
- Consent must be given freely. Participants should not be pressured to participate and should have the genuine option to say no.
- Consent must be specific and informed. Participants should know for which purpose(s) their personal data are going to be used, why, by whom, and for how long.
- Consent must be unambigious. Agreements between researchers and participants must be expressed by using clear and plain language. The researcher is responsible for ensuring that the participant’s consent is fully understood and leaves no room for misunderstanding.
- Consent cannot be implied. It should be achieved through an opt-in, a declaration or an active motion. Consent is not valid if it is given through silence, default selections (pre-ticked boxes), or by doing nothing.
- Consent must be revocable. A participant should be able to withdraw their consent at any time. If they do, their personal data can no longer be used for the research and should be deleted if possible. It is important that withdrawing consent is made as easy for the participant as providing consent.
How to ask for consent
Documenting a participant’s consent can be achieved in various ways. You could ask participants to sign a document (online or on paper), ask them to give an affirmative statement via an audio or video recording, or ask them to tick a box ☑ or answer an email. You may choose whichever of these options suits your need. However, in accordance with Article 13 of the GDPR, it is mandatory to provide certain information to your participants. This information is typically provided in writing (via an information letter or privacy statement). Therefore, preference is generally given to ask consent via a form (online or on paper).
- When asking for consent via an online form, VU researchers are advised to use Qualtrics.
- Store your signed consent forms securily (seperate from the data).
- Consent form documentation needs to be archived for as long as the data are in use.
- When processing special categories of personal data, you are required to ask your participants for explicit consent. Special categories of data include data related to a person’s race, ethnicity, political views, religious or philosophical beliefs, trade union membership, genetics, health, biometrics, sex life, or sexual orientation.
- Different rules may apply when processing personal data that falls under the Medical Research Involving Human Subjects Act (WMO).
- For research that involves participants under the age of 16, additional consent is required by a parent or guardian. Please note that this law may be subject to national regulations.
Dos and Don’ts when asking for consent
| Dos | Don’ts |
|---|---|
| Indicate how you will de-identify the data (where possible) | Use terms such as “fully anonymous” unless you are absolutely sure |
| Indicate when and under what conditions others may be allowed to access the data | Say “I will be the only one with access to the data” |
| Mention that the data will be kept on secure servers with appropriate protection levels | State the name of the specific storage or archiving solution (systems change) |
Note that a VU Informed Concsent Form (ICF) generator is available, which can help you in drawing up an informed consent form. The Faculty of Behavioural and Movement Sciences has a GDPR Checklist for Informed Consent. You can use these resources when you prepare your consent form, but always make sure to discuss your consent form with your ethics committee and 🔒 Privacy Champion, so that it aligns with faculty guidelines and the specific requirements for your study.
Support in your faculty: Privacy Champions
Each faculty has one or more Privacy Champions, who are the first point of contact for questions relating to privacy and the GDPR. The Privacy Champions can help you with completing a Data Protection Impact Assessment, registering your research in the record of processing activities, designing informed consent forms and other questions relating to the GDPR. The 🔒 list of Privacy Champions can be found on the VU website.