11 February 2025

Demystifying Consent for Research Purposes

Sue White, Information Governance Manager, explains the difference between ‘Informed Consent to participate in research’ and ‘Consent as a lawful basis under the UK GDPR.’

Consent is a term that we encounter frequently, but it can be surprisingly complex, especially when it comes to data protection. The word ‘consent’ might seem straightforward – it means agreeing to something or giving permission. However, in the realm of data protection, ‘consent’ takes on a much more specific and stringent meaning.

Agreeing to participate in a research project is different from providing consent under the GDPR for personal data processing. The two should not be confused but often are. Indeed, Consent is most often not the lawful basis which should be used for research activities.

An example of ‘Consent’ in a research study

Imagine Freddy, a researcher at a university linked to a local hospital. He wants to investigate the effect of a new drug on patients. The participants sign a form giving their informed consent, which means they have been given sufficient information to make a meaningful choice about participating. Informed consent is ethical, moral, and legally necessary for individuals to participate in research.

However, because Freddy will be processing personal data, he must identify a lawful basis for processing under data protection legislation. Freddy assesses the lawful bases available:

• Consent: Possibly, but is it the most appropriate?
• Contract: No, there’s no contract with participants.
• Legal Obligation: No, there’s no legal obligation.
• Public Task: Possibly, as Freddy works for a public authority.
• Legitimate Interests: Possibly, if Freddy had worked for an independent research organisation.
• Vital Interests: No, there’s no immediate need to protect life.

Freddy works for a public authority, so he may either rely on Consent or Public Task. Although participants have given their informed consent to participate, Consent under the GDPR is not the most appropriate lawful basis.

But why shouldn’t Freddy use Consent as his lawful basis?

The UK GDPR sets a high standard for Consent:

• Consent must be ‘freely given’ with no power imbalance. If individuals feel obligated or fear adverse consequences, consent is not valid. If you are a research institution undertaking a study, a power imbalance may exist between you and your participants. This is particularly likely if you are a public authority.
• Individuals can withdraw consent at any time, and it must be easy to do so. This means that if you are relying on consent as your lawful basis and someone withdraws their consent, you must immediately stop processing their personal data – which could undermine or even invalidate your research dataset. If you collect personal data using consent as your lawful basis, knowing that you would not be able to fully action the withdrawal of consent as your data set would be undermined, then your use of consent is not valid.
• It’s not just about permission; it’s about giving individuals control over their data.

‘Consent to participate’ = asking for permission.

‘Consent as a lawful basis under the UK GDPR’ = giving full control to the individual.

Freddy should therefore use Public Task as the lawful basis for his research project as this will protect his dataset and ensure there is no question over whether there was a power-imbalance. Of course, if a participant wished to withdraw from the project, they could do so, but if removal of their data would undermine or invalidate the research undertaken, there would be no legal obligation for Freddy to do so.

Conclusion

For research projects, you need consider the ethics of asking people to participate (informed consent) and the legal basis under Data Protection Law (Public Task for public authorities or Legitimate Interests for non-public authorities).

In addition, if you are also processing special category data, you must identify a separate condition for processing under Article 9 of the UK GDPR. Where the processing relates to research purposes, the legislation provides a specific condition, which recognises the importance of such research, (j) Archiving, research and statistics – Data Protection Act 2018

The UK GDPR provides special allowances for research activities. This legislation understands that using personal data is crucial for research and acknowledges that research projects often span many years. Therefore, if researchers collect data properly and adhere to other data protection principles and specific safeguards, they can be exempt from certain restrictions, such as the limitations on the purpose for which the data is used and how long it can be stored. This means that researchers have more flexibility in using and retaining personal data, as long as they follow the necessary safeguards to protect individuals’ privacy.

Further help

If you found this useful and want to deepen your expertise in data protection, explore our training offer, including the Intermediate and Advanced Certificates in Data Protection, or contact our Training Manager at info@naomikorn.com.