Informed consent
If you handle personal data, there are a number of legal grounds on which this can be done. One example involves obtaining consent from the person in question, also known as 'informed consent'. This informed consent must adhere to several requirements.
You must be able to demonstrate that you have received valid consent from data subjects in order to process their personal data. It is critical that they grant that consent voluntarily. If not, you may not process their data, and they have the right to withdraw their consent.
This informed consent must meet a number of requirements:
- Simply documenting the consent is not sufficient. The information on which the consent was given must also be recorded. This allows you to show that people have been properly informed and that they have given their consent for this specific situation.
- You must be able to demonstrate that the consent granted has a clear link to the personal data you process. Consent must be granted separately for each objective.
Informed consent checklist for researchers
Describe your objective as clearly as possible:
- For what purpose are you collecting the personal data
- Include an assurance that you will not use the personal data for any other purpose
- For data subjects younger than 16 years of age, arrange for (co-)consent from the parents/guardians
- Explain how the data subject can withdraw consent
- Provide an example of a consent form
View examples of forms here:
Scientific research consent
Scientific research consent involving children
Anonymise personal data
Important: Anonymise personal data. Consent must be able to be withdrawn at any time. This means that non-anonymised personal data may be deleted.
This does not mean that all data must be deleted, but it does mean that for that specific person all data that can be traced back to that person (such as name, address, etc.) must be deleted (anonymised). The data may be anonymised and used further.