How to write an informed consent form
Informed consent is commonly used as the legal basis to collect personal data in research. Explicitly asking participants whether their personal data can be collected for a particular purpose, gives them an opportunity to be informed, ask questions, and decide whether they wish to participate. By giving participants information and choice, you can fulfil both your legal and ethical requirements - that is, if you adequately formulate your informed consent forms.
When you collect personal data, it is crucial to inform participants about how you are using their data. You should at the very least describe:
- Your research and your team.
- The data you are collecting and how you are using it. Describe explicitly intents to make data available for reuse.
- Participants’ rights, for example the right to withdraw consent and to contact the university's Data Protection Officer.
- Additional information in special cases, for example if you are sharing data outside of the European Economic Area, or if you apply automatic decision making in your project.
In this document, you can find an overview of information that you need to include in your information to participants. Please note that this is a general template and there may be additional requirements imposed by your faculty and/or Ethical Review Board.
How to present the information
The information you provide should be easily understandable and accessible for your participants. So try to include concrete and active language, and consider whether text is the most suitable way to deliver the information (other formats such as audio and video are also allowed). The GDPR also permits layering information to improve readability: you can place the most relevant information in the information sheet preceding the consent and provide external links to pages that contain additional information. The additional information may provide participants with a more detailed breakdown of how their data will be processed, or include the way in which the data will be de-identified, or information on the security of the tools and technologies to be used. An external website with additional information can also be used to inform participants of small changes to the processing that may occur after consent.
To ensure consent is valid, you need to ensure that it is “freely given, specific, informed and unambiguous”, signified by a “clear, affirmative action” (Art. 4 GDPR):
As we move towards more open science practices, researchers are faced with the dilemma of sharing the personal research data they’ve collected whilst protecting the privacy of their participants. To properly determine whether personal data can be shared, a privacy scan is strongly recommended. This is a crucial step wherein you will assess the potential privacy risks. By contacting email@example.com you will be put in contact with a privacy officer who is able to help you with this task. Once you’ve assessed the risks and have determined that the data is fit for sharing it is important to adequately phrase your informed consent form.
When using tick boxes
Be careful with tick-boxes. There must be an opt-in option. Tick-boxes may never be coloured in advance and they should allow for a “Yes” AND “No” option.
“I agree that research data gathered for the study may be published or made available provided my name or other identifying information is not used.”
“I understand that the research data, without any personal information that could identify me (not linked to me) may be shared with others.”
Sharing data under restricted access
In many cases, you will be sharing data under restricted access. This means that the data will be placed in a repository where others are able to find it, but users will only be granted access to the data when approved by the dataset owner.
This enables you to gate who can use the personal data and under which conditions. Upon receiving a request, you will then send the requestors a data transfer agreement determining the purpose of re-use and the privacy measures that the requestors must adopt to use the data. A data transfer agreement template can be found here, although they will often always need adaptation to your particular case. Please contact firstname.lastname@example.org or check the data privacy handbook for more information on this topic.
Sources and further reading
Check the Data Privacy Handbook, a knowledge base and overview of tools to learn about data privacy. This guide was set up by RDM Support of Utrecht University (UU) with input from the UU Faculty Ethics Review Board (FERB) of the Faculty of Social and Behavioural Science.