4.2 What information must I include on an informed consent form?

In accordance with the GDPR, consent (informed consent) must meet a number of conditions.

These requirements only apply if consent is the legal basis on which you process personal data (see 2.2). If for ethical reasons you need the consent of the data subjects but you base your data processing on a different legal basis (eg scientific research in the public interest), these specific requirements do not apply.

• Respondents must be informed in an  understandable and easily accessible form and in a clear and simple language about the objectives of the research and the way in which their personal data will be processed.
• The consent must be  unambiguous, free and specific  and the data subjects must be informed of each purpose for which the data are processed. Pre-checked boxes or inactivity are not allowed within the current legislation because they violate the principles of  privacy by design  and  privacy by default .
• Permission must be obtained  for each individual processing activity . Permission is not valid if different purposes are bundled, so that a person must accept them all or none of them.
• Under the GDPR, those involved have the  right to withdraw their consent at any time . It is important to inform those involved about how they can easily withdraw their consent. In the event that exercising this right involves fundamental risks for the investigation as justified in the register, this must also be stated.
• The (written or verbal consent) must be  documented .
• A given permission can lose its value over time . The 'best before date' of the permission will depend on the context of the research project and on the original permission. It is therefore important to regularly evaluate whether the permission obtained is still consistent with current research activities.

The GDPR acknowledges that it is not always possible for research to fully describe the purpose of data processing at the time of data collection. For this reason, the GDPR stipulates that respondents must have the opportunity to give their consent to certain areas of scientific research ('broad consent') in which recognized ethical standards for scientific research are observed. Hereby it is important to also consider other regulations that are relevant, such as clinical studies, etc.