Skip to main content


The informed consent checklistfor Research Ops people

Understanding how informed consent and compliance affect your organisation can feel overwhelming. We've created a handy checklist to make it easier to get started.

0% complete

Showing a checklist for

GDPR No special category data No children

Before you ask for consent

Data management and housekeeping

Complete an audit of devices, apps or software used to capture and process research data
Identify if or where research data gets backed up to different cloud storage
Create a plan to minimise the spread of personal information over devices and tools
Know how long you need to keep research data for and update your data retention policy
Ensure research data can be completely deleted from the devices and tools you use
Look for other regulations which might govern your field of study, beyond GDPR
Look for other regulations which might govern your field of study, beyond CCPA?
Look for other regulations which might govern your field of study, beyond PIPEDA?
Say hello to the Data Protection Officer (DPO) in your organisation, if you have one

Obtaining consent from children

If the child is under 16 years of age, you also need to get consent from a parent or guardian, and assent from the child.
Acknowledge and consider the power imbalance between adults and children.
Don't assume that the children know about your research. Allow time for an explanation at the beginning of your session.
Create a visual cue such as a pamphlet to communicate the purpose of your research. Use this as a basis for discussion.
If you are recording, allow enough time to explain why you want to record and who else will see or hear it.
Plan alternative activities during the study. Allow children to renegotiate their participation by choosing to do something else.

Writing the consent form

Use simple language that the participant can understand
Explain why you are doing the study and, if appropriate, who you are doing it for
Let the participant know what they should expect if they take part, and if anyone else will be there with you
Explain what data you would like to record and why
Let people know what will happen to any data you record and how you intend to use it
State who else will see any data that you record
Give a meaningful choice about what you record, how you will use it and who will see it
Provide contact details and invite the participant to ask questions
Make it clear that participation is voluntary
Make it clear that the participant can withdraw at any time and with no loss to themselves
Provide clear instruction for how they can withdraw, should they want to
Share a link to your organisation's Privacy Notice. Record that the participant has confirmed that they have read and understood it.

GDPR Compliance

Understand how you will support the right to access
Understand how you will support the right to withdraw
Understand how you will support the right to erasure
Check the processing of special category data is necessary
Document which special categories of data you are processing
Consider the need to do a Data Protection Impact Assessment (also known as a DPIA)

When you ask for consent


Give enough time for consideration between asking for consent and the session beginning
Give time to talk through consent with the participant, using visual aids or props as necessary
Be aware of power imbalance between researcher and participant. Make attempts to counteract any feelings of obligation that you sense.
Ensure that the form is easy to sign, without needing things like printers or to install software
Make it clear that participation is voluntary and they are free to leave at any time
Ensure your consent form meets accessibility standards and works with a screen reader
Keep a log of how, what and when you asked for consent
(If required) think about how you will assess the participants' decision making capacity

After you ask for consent


Share your process for withdrawing participants with researchers
Share your process for data subject access requests with researchers
You have shared a process for withdrawing someone from the research with researchers
You have a centralised view of who has and has not given consent
Link any recordings and research data to the signed consent
Permission to use any research recordings are available to those with access to them
Made sure that if you've said you would anonymise or de-identify research data then you have
Made sure that only people disclosed in the consent form have access to the research data
Take steps to ensure you delete data within the time agreed in the consent form
Have a plan for handing over responsibilities if anyone leaves or move teams
Checkbox option

Did you find this useful?

Help us to spread the word and improve ethical research practices.