Is consent required under governance principles?

The SHIP Guiding Principles and Best Practice are guidelines which are illustrative of optimal information governance. You should seek to follow these guidelines when determining whether you need to seek consent to use personal data in your research project.


  • Personal data must not be used without consent unless absolutely necessary.
  • Where possible and practicable, consent should be obtained from each data subject prior to the use and sharing of personal data for research purposes.
  • The refusal of data subjects must be respected unconditionally.
  • Where possible and practicable, individuals collecting data should adequately inform data subjects of all material issues relating to the storage and use of their data. Material issues are those likely to affect a person in a non-trivial way.
  • Where personal data are used, the minimum amount of personal data should be used to achieve the stated objective.
  • Where personal data are used, the reasons and justification for its use are adequate and clearly explained.
  • Where personal data are used, every reasonable effort should be made to inform data subjects of the purposes of the use.
  • Where obtaining consent is not possible/practicable, then (a) anonymisation of data should occur as soon as is reasonably practicable and/or (b) authorisation from an appropriate oversight body/research ethics committee should be obtained.

Best Practice

  • Consent procedures should be designed to obtain free and meaningful consent, that is, data subjects must be given sufficient information to make a decision that reflects their genuine wishes, must be given the opportunity to ask questions and have these answered, and must not be subject to coercive measures.
  • Where there is the prospect of future use of data that is unknown at the time of consent, then data subjects should be informed of the broad purposes for which the data might be used. These purposes will delimit the appropriateness of any future use.
  • Where consent is not to be obtained, the reasons for this must be clearly articulated and adequately justified.
  • Vulnerable populations should be given adequate protections with respect to their needs.
  • Cultural/religious beliefs should be respected in the approaches that are employed to consent/refusal and data use. These should reflect the NHS obligations in relation to equality and diversity.
  • Privacy notices used to inform individuals about the processing of their data must be sufficiently specific to be meaningful and must adequately reflect the range of purposes for which the data will be used. Reasonable effort must be made to draw these to the attention of data subjects.

Return to top of page

Return to route-map