Informed consent

If you are conducting research involving people, you need to obtain informed consent from your respondents. Informed consent is an agreement between the researcher and the respondent in which you give the respondent a genuine choice in the processing of their data. This agreement has to be documented according to the GDPR.

Your informed consent procedure

Your informed consent procedure is a required part of your research design. In this section, you include your decisions on data sharing, anonymisation and publicizing data. The decisions made in the stage of designing the informed consent procedure determine what you can legally do with the data in a later stage of your research.

Obtaining informed consent

To obtain consent, you need to:

  1. Inform the respondent on the research project. The respondent needs to have a sufficient understanding of the project before agreeing to participation. You can do this, for example, by providing an information document or brochure beforehand.
  2. Receive an explicit statement from the respondent stating that they freely agree to participation in the research project. As long as the respondent is asked to actively opt-in, you can obtain and document their consent in various ways. A few methods are suggested below.
  3. Document this explicit statement of consent to be able to demonstrate that your respondents gave informed consent in your research project.

Methods for obtaining consent

Generally used methods for obtaining consent are:

  • A consent form, either signed on paper or digitally. On paper, keep a copy of the signed form with the date. Digitally, document the consent workflow by exporting the emails in which consent was given.
  • An online survey. Keep a copy of the completed survey including a time stamp by exporting the data.
  • Oral consent. In this case, the respondent gives oral consent on audio/video record, or in the presence of a witness. Make sure to keep a record of:
    • Who consented (the name of the respondent or other identifier)
    • When the respondent consented (a note of the time and date)
    • How the respondent consented (keep a short note of the conversation at that time, describing the reply of the respondent)

In all cases, you need to keep a copy of the information that was presented to the respondent at that time.

Consent form requirements

Research in institutions

In case your research concerns an institutional environment such as a school, health care institution or company that recruits participants, make sure that all individuals from which you collect data sign a consent form.

Research with minors or ‘incompetent’ participants

If your potential respondents are minors, children, babies, or mentally/physically incapable to give informed consent, make sure to check the regulations of your faculty's ethics committee. In these cases, you most likely need to obtain permission from the parent or legal guardian.

Medical research

Please note: the requirements for informed consent can be different in case of research that falls under the Medical Research Involving Human Subjects Act (WMO). You may contact the Medical Research Ethics Committee Oost-Nederland (MREC Oost-Nederland) or the Central Committee on Research Involving Human Subjects (CCMO) in case of questions on informed consent procedures.

The right to withdraw consent

The GDPR states that a researcher should make sure that consent can be withdrawn by the respondent in a way that is as easy as it was given and at any time, without having to give a reason. For example, if a respondent gave informed consent by means of a phone call, the respondent should have the option to withdraw consent by calling.

Informing participants afterwards

In some research projects participants are informed afterwards to prevent influencing participants during the data collection process. If this is the case for your research, consult your faculty's ethics committee to assess the ethical admissibility of your research proposal.

Managing documentation

As records of informed consent contain personal data, they have to be treated like any other personal data. More information about how to store personal data can be found here.