Resource
The informed consent checklistfor Research Ops people
Understanding how informed consent and compliance affect your organisation can feel overwhelming. We've created a handy checklist to make it easier to get started.
Showing a checklist for
GDPR
No special category data
No children
Filter checklist
Before you ask for consent
Data management and housekeeping
Complete an audit of devices, apps or software used to capture and process research data
Understanding how data moves through your processes helps to identify risks around how you handle personally identifiable information. We created a workshop to run with your researchers to map out these processes while aligning them on best practices.
Identify if or where research data gets backed up to different cloud storage
Many apps and devices back-up data captured automatically to their clouds. It's important to be mindful of this, especially when dealing with PII and sensitive data.
Create a plan to minimise the spread of personal information over devices and tools
One of our Data Management Workshop outcomes is that your researchers understand their processes, reflect and make adjustments if necessary.
Know how long you need to keep research data for and update your data retention policy
The relevance of different types of data can have different shelf lives. Consider the recordings from a usability test, over research into deeper cultural perspectives. Think about how long that data is practically useful for and adjust your retention policies accordingly.
Ensure research data can be completely deleted from the devices and tools you use
Some cloud providers prevent full deletion of files from their servers, instead of moving files to a trash folder. Double-check that you can delete things.
Look for other regulations which might govern your field of study, beyond GDPR
The Research Ops Community have curated a list of Global PII Laws which could affect how you process research data.
Look for other regulations which might govern your field of study, beyond CCPA?
The Research Ops Community have curated a list of Global PII Laws which could affect how you process research data.
Look for other regulations which might govern your field of study, beyond PIPEDA?
The Research Ops Community have curated a list of Global PII Laws which could affect how you process research data.
Say hello to the Data Protection Officer (DPO) in your organisation, if you have one
Obtaining consent from children
If the child is under 16 years of age, you also need to get consent from a parent or guardian, and assent from the child.
Acknowledge and consider the power imbalance between adults and children.
Plan how to approach the child to take part in the study. Think about how to do this so it is the child's free will (not an adult telling them to). This might also occur in how you introduce yourself to the children. Perceived alliances with other adults, such as a teacher can lead a child to believe they must take part.
Don't assume that the children know about your research. Allow time for an explanation at the beginning of your session.
If participation has been negotiated through adults it is best not to assume that children have been fully informed about your research. Allow for time to explain the purpose and invite questions at the beginning of your session.
Create a visual cue such as a pamphlet to communicate the purpose of your research. Use this as a basis for discussion.
Use this as a basis for a discussion about the research, whether you plan to record or not and that they can decide not to take part or answer particular questions if they don't want to. Always invite questions.
If you are recording, allow enough time to explain why you want to record and who else will see or hear it.
Some children may be sensitive to recording what they say or do. Give them an opportunity to say what they think and ask questions. If you are working with a group and one child objects, it is best to not record the entire group.
Plan alternative activities during the study. Allow children to renegotiate their participation by choosing to do something else.
Where possible, provide options for activities that may differ from the study which the child can choose to do instead. Welcome children who choose to rejoin or take part later in the study.
Writing the consent form
Use simple language that the participant can understand
Try to make the form as simple as possible, avoid design and legal jargon and invite questions where possible.
Explain why you are doing the study and, if appropriate, who you are doing it for
Part of understanding the consequences an individual might encounter is to understand the motivation of the research and actors involved in it. Knowing this allows people to make a more informed decision about whether to take part or not.
Let the participant know what they should expect if they take part, and if anyone else will be there with you
Most people probably haven't taken part in a research study before, and will likely feel anxious about what to expect. Knowing this upfront can help to remove those anxieties.
Explain what data you would like to record and why
Being recorded often makes people nervous and can change the entire dynamic of the session. Let them know upfront what you would like to record and why, before offering them a meaningful choice about whether you record or not.
Let people know what will happen to any data you record and how you intend to use it
Knowing what those recordings will be used for can help people to understand if they are comfortable with it or not.
State who else will see any data that you record
Knowing who else will see the research data before it is de-identified or anonymised (while the participant is potentially exposed) can reassure them that their information is safeguarded appropriately.
Give a meaningful choice about what you record, how you will use it and who will see it
Using checkboxes is useful in giving the participant a meaningful choice about how their data is used. It does not coerce into taking part (e.g., agree to all of the above) and enables them to take part if they are not comfortable with being recorded.
Provide contact details and invite the participant to ask questions
If the participant has questions, it should be clear (and easy) for them to know who to ask, how they can ask and that it is okay to do so.
Make it clear that participation is voluntary
It should be clear to the participant that participation is voluntary.
Make it clear that the participant can withdraw at any time and with no loss to themselves
It should be clear (and easy) for the participant to be able to withdraw from the study at any point in time.
Provide clear instruction for how they can withdraw, should they want to
The process for how to withdraw from the research should be made clear; typically, this will be to email a researcher.
Share a link to your organisation's Privacy Notice. Record that the participant has confirmed that they have read and understood it.
Your organisation should have a privacy notice or privacy policy which details how you process information. This can be shared with the participant when obtaining consent to process their data.
GDPR Compliance
Understand how you will support the right to access
Participants have the right to access. This is a request for all information you have about them relating to a specific topic. How might you access and report that information to them?
More information: Managing subject data access requests.
More information: Managing subject data access requests.
Understand how you will support the right to withdraw
Participants have the right to withdraw their consent. When do you anonymise data? Is it ever impossible to remove participant past a certain point?
Some projects provide a date after which it is impossible to withdraw consent.
Some projects provide a date after which it is impossible to withdraw consent.
Understand how you will support the right to erasure
Participants have the right to request you delete their data. Check you have measures in place to delete it and that deletion is actually possible.
More information: Participants right to erasure.
More information: Participants right to erasure.
Check the processing of special category data is necessary
Make sure you need to collect and process special category data before doing so. Is there another way to achieve your purpose without this data?
Document which special categories of data you are processing
Special category data is any personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data (where used for identification purposes)
- data about health
- data about a person's sex life
- or data about a person's sexual orientation
Consider the need to do a Data Protection Impact Assessment (also known as a DPIA)
Collaboration with your Data Protection Officer if you need to write a DPIA.
For more information see the guidance from the ICO.
For more information see the guidance from the ICO.
When you ask for consent
Housekeeping
Give enough time for consideration between asking for consent and the session beginning
Give time to talk through consent with the participant, using visual aids or props as necessary
Be aware of power imbalance between researcher and participant. Make attempts to counteract any feelings of obligation that you sense.
Ensure that the form is easy to sign, without needing things like printers or to install software
Make it clear that participation is voluntary and they are free to leave at any time
Ensure your consent form meets accessibility standards and works with a screen reader
Keep a log of how, what and when you asked for consent
Logging interactions makes life A LOT easier when you do a subject data access request. Emails will contain identifiable information and are part of any DSAR response
(If required) think about how you will assess the participants' decision making capacity
After you ask for consent
Housekeeping
Share your process for withdrawing participants with researchers
This might involve saving the state of the consent form and allowing the participant to simply change their selected options. Using Consent Kit allows the participant to do this, and notifies the researcher by email if it happens.
Share your process for data subject access requests with researchers
See the guidance from the ICO on handling data subject access requests. Using Consent Kit enables you to generate a report of all interactions with the participant, the consent they gave and links to any data recorded during the research.
You have shared a process for withdrawing someone from the research with researchers
You can kick start the withdrawal process from within Consent Kit. Deleting their data will notify the researcher(s) responsible for that participant of all follow-up actions required, such as deleting any remaining recordings.
You have a centralised view of who has and has not given consent
Link any recordings and research data to the signed consent
Linking recordings makes it much easier to find for data subject access requests.
Permission to use any research recordings are available to those with access to them
Made sure that if you've said you would anonymise or de-identify research data then you have
Made sure that only people disclosed in the consent form have access to the research data
Take steps to ensure you delete data within the time agreed in the consent form
You can set your data retention policy globally in Consent Kit. This will start a countdown for each recording linked, based on the agreed retention policy in the consent form the participant signed.
Have a plan for handing over responsibilities if anyone leaves or move teams
Assigning a new team member to be the owner of a project in Consent Kit will make them the recipient of any notifications regarding deleting data or withdrawing participants from research automatically.