Skip to main content Skip to navigation


Informed Consent

Informed consent is defined as:

“given by a competent individual who has received the necessary information; who has adequately understood the information; and who, after considering the information, has arrived at a decision without having been subjected to coercion, undue influence or inducement, or intimidation” Council for International Organizations of Medical Sciences.

Three basic principles apply. Consent needs to be:

  • Informed: given in possession and understanding of the principal, relevant information;
  • Voluntary: given freely and not as a result of coercive pressure (real or perceived);
  • Competent: given by somebody able, in virtue of their age, maturity and mental stability, of making a free, considered choice.

Obtaining Consent

In order to obtain informed consent a prospective participant, prior to participating in research should be fully informed about:

  • all aspects of the research project, which might reasonably be expected to influence willingness to participate. In addition, the researcher must explain all other aspects of the research about which the prospective participants enquire. Such aspects will include some or all of the following:
  • the nature and objectives of the project
  • the methodology of the project and conditions under which it is to be conducted
  • who is undertaking and who is funding the project
  • the potential risks and inconveniences that may arise
  • the potential benefits that may result
  • what participation in the research will require
  • (in the case of medical research) alternative treatments

The participant should freely and voluntarily give consent to participate in the research. Giving and obtaining consent can be a process, not always a one-off event and participants have the right to change their minds and withdraw consent at any time. If a researcher doubts whether a person participating in research still consents to participating s/he must clarify this with the person in question.

If the prospective participant is, for any reason, unable to understand the implications of participation, then the researcher is responsible for obtaining the informed consent of the parents / legal guardians of the prospective participant (see children and adults lacking capacity)

Informed consent for NHS Research Studies

The stipulation that researchers seek consent after providing appropriate information is a central theme in modern research ethics. Applicants to the NHS for approval of research involving the NHS should follow the guidance on Informed Consent provided by NRES and use the templates provided Guidance on Participant Information and Consent Forms.

Further information can be found at Explaining Research on the NRES website.

Informed Consent for non-research studies

Audits and evaluations of patient records can only be undertaken without informed consent in cases where the applicant is part of the team that has clinical responsibility for the patient, and thereby has access to their records automatically in their capacity as the patient’s clinician.

Audits and evaluations of patient records being undertaken by a clinician who does not have clinical responsibility for the patients (even if they are in the same Trust/Hospital) are required to obtain informed consent.

Applicants planning to publish the results of audits, evaluations or similar studies that involve patients are also advised to obtain informed consent as academic journals are increasingly making this a requirement of publication.

Researchers should normally carry out investigations with the valid consent of participants having taken all reasonable and practicable steps to ensure that they, or their authorised representatives, have adequately understood the nature of the research and any anticipated consequences. Under no circumstances must coercion be used to obtain a person’s consent to participate in research. Ideally consent should be obtained in writing but where this is not possible oral consent should be obtained.

Informed Consent Legal Requirements

Consent is not defined in the Data Protection Act. However, the European Data Protection Directive (to which the Act gives effect) defines an individual’s consent as:

“any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”.

The fact that an individual must “signify” their agreement means that there must be some active communication between the parties.

An individual may “signify” consent other than in writing, but The University should not infer consent if an individual fails to respond to a communication, for example, from a customer’s failure to return a form or respond to a leaflet.

Consent must also be appropriate to the age and capacity of the individual and to the particular circumstances of the case. For example, if your organisation intends to continue to hold or use personal data after the relationship with the individual ends, then the consent should cover this.

Even when consent has been given, it will not necessarily last forever. Although in most cases consent will last for as long as the processing to which it relates continues, you should recognise that the individual may be able to withdraw consent, depending on the nature of the consent given and the circumstances in which you are collecting or using the information. Withdrawing consent does not affect the validity of anything already done on the understanding that consent had been given.

You should review whether consent you have been given remains adequate as your organisation’s relationship with an individual develops, or as the individual’s circumstances change.

Consent obtained under duress or on the basis of misleading information does not adequately satisfy the condition for processing.

The Data Protection Act 1998 (“DPA”) distinguishes between:

  • the nature of the consent required to satisfy the first condition for processing; and
  • the nature of the consent required to satisfy the condition for processing sensitive personal data, which must be “explicit”.

This suggests that the individual’s consent should:

  • be absolutely clear
  • cover the specific processing details
  • identify the type of information (or even the specific information);
  • state the purposes of the processing
  • highlight any special aspects that may affect the individual, such as any disclosures that may be made.

As explained above, a particular consent may not be adequate to satisfy the condition for processing (especially if the individual might have had no real choice about giving it), and even a valid consent may be withdrawn in some circumstances.

For these reasons an organisation should not rely exclusively on consent to legitimise its processing. It is better to concentrate on making sure that you treat individuals fairly rather than on obtaining consent in isolation.

Consent is the first in the list of conditions for processing set out in the Act, but each condition provides an equally valid basis for processing personal data

For further information on the Data Protection Act and University policy, please also refer to the University of Warwick's Data Protection Policy web pages.