Consent to Participate vs. Permission to Process Personal Data: Are They the Same Thing?

If a Participant Signs the Consent Form, Has Everything Been Authorized?

A participant reads an information sheet, signs a consent form, and joins your study. You will collect their questionnaire responses, demographic information, interview recording, or health information as part of the research.

It is easy to conclude that the signature settles both questions: the person agreed to participate, so you also have whatever permission is needed to process their personal data.

Sometimes consent may be relevant to both. But participation consent and consent as a legal basis for processing personal data are conceptually distinct, and under some data protection frameworks the research may process personal data on a legal basis other than consent.

Participation Consent and Data Processing Consent Are Not Automatically the Same

One Study Can Contain More Than One Kind of Consent

Consent to participate protects the person's decision about joining the research

Informed consent is a central concept in research involving human participants. Ethical frameworks such as the Belmont Report and the Declaration of Helsinki emphasize respect for people's autonomy and their ability to make an informed, voluntary decision about participation.

The participation question is essentially: does this person understand enough about the proposed research to decide whether to take part, and is that decision voluntary?

The information normally relevant to that decision may include the purpose of the study, what participation involves, foreseeable risks or burdens, potential benefits, alternatives where relevant, confidentiality arrangements, and the participant's ability to decline or withdraw according to the applicable research requirements.

This is an ethical research relationship. It concerns what researchers are asking a person to undergo or contribute as a participant.

Data protection asks a different legal question

Once a study processes information about an identifiable person, applicable data protection law may require a legal basis or other lawful condition for that processing.

Under the GDPR, for example, consent is only one of several lawful bases under Article 6. Depending on the circumstances, research-related processing may instead rely on another basis such as public task or legitimate interests. Processing special-category data requires an additional applicable condition.

UK Information Commissioner's Office research guidance expressly distinguishes consent to participate in a research study from consent as a UK GDPR lawful basis. It notes that a separate ethical or legal obligation to obtain participation consent does not mean GDPR consent is necessarily the appropriate basis for processing personal data.

The European Data Protection Board likewise distinguishes consent used as a GDPR legal basis from other consent requirements that operate as ethical standards or procedural obligations.

The same form can contain both, but the purposes should remain clear

Conceptually distinct does not necessarily mean physically separate. Current European Data Protection Board guidance states that a controller may request consent to participate in research and GDPR consent to process personal data through the same interface or form, provided the different requests are sufficiently distinguishable. Particularly complex or sensitive processing may warrant a separate interface or form.

This is an important drafting point. Researchers do not necessarily need a small forest of forms. They do need to avoid making different decisions look like one indistinguishable blanket agreement.

If a study relies on a different legal basis for data processing, the participant information should likewise avoid implying that the researcher's legal authority to process the data exists only because the participant clicked an "I consent" box.

A lawful basis is not the same thing as permission to participate

Consider a university research project conducted under a legal framework in which the institution appropriately relies on public task for particular research processing. The researcher may still need participants' informed consent before enrolling them in interviews, interventions, experiments, or other research procedures.

The participant's ability to refuse the study remains meaningful. Refusing participation means the researcher should not enroll the person merely because the institution has a lawful basis that could support some processing of personal data.

Conversely, a signed research consent form does not excuse the institution from identifying the correct legal basis and satisfying the other applicable data protection requirements. This reflects the broader distinction between research ethics and data protection compliance.

Why not simply use data protection consent for every research project?

Because valid data protection consent can have demanding conditions. Under the GDPR, consent must be freely given, specific, informed, and unambiguous, and withdrawal must be possible. Whether consent is genuinely freely given may also be problematic where a significant imbalance of power exists.

The European Data Protection Board's 2026 summary of GDPR consent emphasizes genuine choice and control. If a person feels compelled to consent or faces negative consequences for refusing, consent may not be valid.

ICO research guidance therefore cautions that consent is often not the most appropriate lawful basis for research-related processing, particularly where researchers could not fully honor withdrawal of consent as the data-processing basis or where a power imbalance undermines freely given consent.

This does not make consent undesirable in research. It means researchers should stop treating the word consent as though it performs exactly the same legal and ethical function everywhere it appears.

Withdrawal can mean different things depending on what is being withdrawn

This distinction becomes particularly important when a participant says, "I withdraw my consent."

Are they withdrawing from further research procedures? Do they want no further contact? Are they withdrawing a data protection consent on which processing depends? Are they requesting deletion of previously collected information? Can already anonymized data still be connected to them? Are there legal or research provisions affecting what happens to previously collected data?

Those questions may have different answers. Researchers should therefore explain withdrawal accurately rather than promising that every trace of a participant's data can always be removed in every circumstance.

The Philippine Data Privacy Act also distinguishes consent from other grounds for processing

Under the Philippine Data Privacy Act of 2012, consent of the data subject is defined as a freely given, specific, informed indication of will agreeing to the collection and processing of personal information. But consent is not the only condition listed for lawful processing of personal information. Section 12 also provides other grounds, including processing necessary for a contract, legal obligation, vital interests, certain public-authority functions, and legitimate interests subject to the statutory conditions.

Sensitive personal information is governed separately under Section 13, with its own permitted circumstances. Researchers working under Philippine law should therefore identify the specific provisions applicable to the information and processing rather than assuming that a research participation signature resolves every data privacy requirement.

The implementing rules also contain particular provisions concerning scientific and statistical research. These provisions should be read with the project's facts and current National Privacy Commission guidance rather than treated as a blanket research exemption.

Transparency still matters when consent is not the lawful basis

If personal-data processing relies on a lawful basis other than consent, this does not mean researchers can quietly process whatever information they want. Applicable principles concerning lawfulness, fairness, transparency, purpose limitation, minimization, security, accountability, and participant rights may still apply.

Researchers should explain what information is being processed, why, by whom, for how long, with whom it may be shared, and what rights apply, to the extent required by the governing framework.

This is also why deciding which personal data the study actually needs remains important regardless of the legal basis selected.

One Participant, Two Different Decisions

The participant's signature remains important. It establishes their voluntary agreement to take part according to the applicable research process. What it does not do is magically transform every subsequent act of personal-data processing into consent-based processing.

Where the Word "Consent" Creates Confusion

Know Which Decision You Are Asking the Participant to Make

When preparing participant information and consent materials, map the decisions before drafting the checkboxes. Do not begin with a generic sentence saying, "I consent to participate and to all processing of my data."

Coordinate this with the person or office responsible for data protection at your institution. The appropriate lawful basis is generally an organizational compliance decision, not a phrase a researcher should improvise while drafting the participant information sheet.

You should also know who is responsible for protecting the personal data, because the legal responsibility for processing may sit with an institution or another entity rather than solely with the researcher whose name appears on the consent form.

Before Finalizing a Research Consent Process

Common Questions About Research Consent and Personal Data

A Signature Can Serve a Research Decision Without Answering Every Data Protection Question

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.