Guidance: Writing a Consent Form

1. Why the consent form matters

An informed consent form is not just an administrative requirement. It is the written record that the participant has been given enough information to decide freely whether to take part in a study.

A good consent form should show that:

• the participant knows what the study is about;
• the participant knows what will happen to them;
• the participant knows what data, samples or information will be collected;
• participation is voluntary;
• the participant can withdraw, subject to any limits explained in the Information Sheet;
• the participant knows how their data will be used, stored and protected; and
• the researcher has checked that the participant had the opportunity to ask questions.

CMMB FREC consent form templates require the form to be written in the first person ("I have read and understood...", "I agree to take part..."), because the consent form records the participant's own decision to take part - it is their statement, not the researcher's.

2. Choosing the correct template

Clinical studies template

Use a clinical-studies consent form when the study involves clinical research, clinical procedures, observations, tests, biological samples, study-related follow-up, treatment-related monitoring, adverse event monitoring, or any research conducted in a clinical care setting. This template typically includes wording on observations/tests, sample collection, possible inconvenience, withdrawal, adverse effects, treatment within Government Health Services, remuneration, GDPR rights and data retention.

Qualitative studies template

Use a qualitative-studies consent form when the study involves questionnaires, interviews, focus groups, discussion groups, or stakeholder consultations. This template should carry specific wording for focus groups, interviews and questionnaires - including the use of extracts/quotations and the limits of confidentiality in group settings.

Mixed studies

If the study has both clinical and qualitative elements, use the clinical-studies structure as the main framework, and insert the relevant qualitative wording for interviews, focus groups or questionnaires.

Why this matters

The participant must know what kind of study they are entering. A consent form for a blood test or clinical intervention should not look the same as one for a focus group - the risks, expectations and protections are different, and the wording should reflect that.

3. Identifying the participant group & completing the study details

3.1 Identifying the participant group

At the very start of the form, state clearly who it is for. For example:

• "This informed consent form is for adult patients attending [clinic/department] who are being invited to participate in the research study titled '[insert title]'."
• "This informed consent form is for healthcare professionals working at [insert institution] who are being invited to participate in the research study titled '[insert title]'."

One study may involve several groups - patients, carers, healthcare professionals, students, or members of the public - and each group may need different reassurances. A patient needs reassurance that refusal will not affect their care; an employee or student needs reassurance that refusal will not affect their employment or education.

3.2 Completing the study details

Include, near the top of the form:

• Name of Principal Investigator: [insert name]
• Name of Organisation: [insert organisation]
• Name of Sponsor (if applicable): [insert sponsor]
• Name of Proposal, Version and Date: [insert title / version / date]

Participants should know who is responsible for the study, and CMMBrec needs to see that the consent form matches the approved protocol, the Information Sheet, and the version date. Version control matters - researchers must always be able to show exactly which version of the form a given participant signed.

4. Opening paragraph & describing what participation involves

4.1 Opening paragraph: invitation, explanation and questions

Avoid repeating the same idea several times - the opening paragraph only needs to confirm three things: that the participant was invited, that the study was explained, and that the participant had a chance to ask questions. It should also link the consent form back to the Information Sheet, where the fuller explanation can be found.

4.2 Describing what participation involves

For clinical studies - the consent form should not overload the participant with every technical detail, but it must clearly point to the procedures described in the Information Sheet. This avoids vague consent and confirms that the procedures, tests or samples involved are genuinely part of what the participant is agreeing to.

For focus groups - focus groups differ from interviews because other participants will hear what is said. Participants need to know how long the session will last, whether it will be recorded, how their words may be used, and that the research team cannot fully control what other participants might repeat outside the group.

For interviews - participants should know whether they are being recorded, how long the interview will take, and whether quotations may be used. If quotations are used, the researcher must explain how the participant's identity will be protected.

For questionnaires - these may appear low-risk, but they can still collect sensitive information. Participants should know what they are completing, roughly how long it will take, and whether their responses are anonymous, coded or identifiable.

5. Future use of samples or data

Researchers may want to use samples or data again in future studies. This can be acceptable, but it should not be left completely open-ended. The participant should know the broad area of any future research, that future use will require fresh ethical approval, and that safeguards will apply - the Information Sheet should explain this in more detail.

Specifically, consent for future or secondary use is only valid where participants have been adequately informed of: the purpose or broad area of the research repository; how long data or samples will be stored; who will have access; how privacy and confidentiality will be protected; their right to withdraw consent at any time without reprisal; and that any new research use will require independent ethics committee approval to confirm whether the original consent remains sufficient or whether additional measures are needed.

These requirements are grounded in international research ethics standards, including the WMA Declaration of Taipei (paragraphs 12, 15 and 19), the WMA Declaration of Helsinki (paragraph 32), and the CIOMS International Ethical Guidelines. Under EU data protection law, the GDPR permits broad consent for research only within "certain areas of scientific research" and "in keeping with recognised ethical standards" (Recital 33); any such processing must be subject to appropriate technical and organisational safeguards, with particular regard to data minimisation (Article 89(1)). Consent that is entirely open-ended - specifying neither the area of research nor the governance arrangements - satisfies neither the ethical nor the legal standard.

Transparency is not a one-time obligation limited to the moment of consent. Repositories and research teams should also consider ongoing transparency mechanisms - newsletters, study websites, or email updates - to keep participants informed about how their samples and data have been used. Where a repository is publicly funded or has broad public significance, public disclosure of its governance arrangements, access policies and the types of research undertaken is also good practice. Researchers should also be aware that, where data are collected but not obtained directly from the participant (for example, in secondary data-linkage studies), GDPR Article 14 imposes specific obligations to inform data subjects of the new processing purpose - subject to limited exemptions where this would involve a disproportionate effort, in which case alternative public transparency measures (such as a publicly accessible notice) are required instead.

6. Use of results and publication

Participants should know that their contribution may be used in research outputs - reports, journal articles, conference presentations, teaching material, service evaluation reports, public health documents, policy papers or other scientific outputs. The consent form should make clear that study results may be reported or published, while also making clear that the participant will not be personally identified. This is already reflected in CMMB FREC consent form templates, which state that study results may be reported or published but that the participant will not be personally identified.

This point is especially important in Malta. Because Malta has a small population, some participants may remain identifiable even when their name is removed - this risk is higher in studies involving rare diseases, rare cancers, small professional groups, single specialist clinics, uncommon family structures, or unusual combinations of age, diagnosis, locality, occupation or clinical history. A participant may not be named, but someone familiar with the context may still recognise them.

Researchers should therefore apply data minimisation when preparing publications and presentations. EDPB guidance emphasises that controllers should consider the amount and type of personal data processed, the risk of re-identification, and risks linked to publishing or sharing research results - and the GDPR principle that personal data should be adequate, relevant and limited to what is necessary for the research purpose.

In practice, avoid publishing unnecessary detail. For example:

For qualitative studies, particular care is needed with quotations: a quote may reveal identity through wording, role, personal history, local references, or a distinctive event. Researchers should review quotations before publication and remove or generalise details that are not necessary for the scientific point - the same applies to case descriptions in clinical studies.

Do not assume that removing a participant's name is enough to protect identity. In Malta - and especially in research involving rare conditions, small patient groups, specialised services or small professional communities - participants may be identifiable from combinations of details. Before publishing or presenting results, ask whether each detail is necessary: use age bands instead of exact ages, broader regions instead of localities, general professional categories instead of specific posts, and avoid reporting sex, gender, diagnosis details, family history, dates or quotations where these are not needed for the scientific purpose.

7. Data retention

Participants should be told how long their data will be kept, or at least how the retention period will be decided - this is part of transparency. The GDPR requires controllers to provide participants with information about "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period".

Avoid vague wording such as "Data will be kept for as long as necessary." A better form of words is:

"Study data will be retained in coded/pseudonymised form for [insert number] years after the end of the study, unless a longer period is required for scientific, regulatory, audit or other justified purposes and has been approved where required."

The GDPR also embeds the principle of storage limitation. Article 5(1)(e) requires that personal data be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." It does, however, allow longer storage where data are processed only for archiving in the public interest, or for scientific/historical research or statistical purposes - provided the safeguards required by Article 89(1) are in place.

Use "anonymous", "coded" and "pseudonymised" carefully

Data should not be described as anonymous if the participant can still be re-identified through a code key, participant list, hospital number, contact details, audio recording, or any other link. The GDPR defines pseudonymisation as processing personal data so that they can no longer be attributed to a specific person "without the use of additional information" - provided that additional information is kept separately and protected by technical and organisational measures. This means pseudonymised or coded data are still personal data if someone can re-identify the participant using a separate key. Recital 26 confirms that pseudonymised data which "could be attributed to a natural person by the use of additional information" remain information about an identifiable person - whereas truly anonymous data, where the person "is not or no longer identifiable", fall outside the GDPR altogether, including for statistical or research purposes.

For this reason, the consent form and Information Sheet should say exactly what will happen:

• Use "coded" or "pseudonymised" where names and direct identifiers are removed but a key still exists.
• Use "anonymised" only where no one can reasonably re-identify the participant.
• Use "identifiable" where names, contact details, voice recordings, images, hospital numbers or other identifiers are retained.

Do not describe data as anonymous merely because a participant's name has been removed - if a code key, audio file, contact list, hospital number or other link still exists, the data are coded or pseudonymised (not anonymous), and the GDPR continues to apply in full.

8. Voluntary participation and withdrawal

8.1 Voluntariness of consent and power imbalance

Consent is only valid if it is genuinely voluntary. It is not enough that the participant signs the form - they must be able to decide freely, without fear, pressure, obligation, or any concern that refusal will affect their care, employment, studies, services, or relationship with the institution.

The Declaration of Helsinki states that participation in medical research must be voluntary, and that capable individuals may only be enrolled if they freely agree. It gives special attention to dependent relationships: where a potential participant is dependent on the researcher, or may feel under pressure, consent should be sought by an appropriately qualified person who is independent of that relationship. This does not mean an intermediary is required in every study - only that one should be considered where the relationship itself could affect the participant's freedom to refuse.

The pressure does not need to be explicit - a participant may feel obliged simply because the invitation comes from someone in authority. The Information Sheet and consent process must therefore make the participant's freedom to refuse clear and specific. Power imbalance can arise in many settings, not only clinical care:

8.2 When should an independent person take consent?

Consider an independent person where the person inviting the participant has a role that could influence the decision - e.g. a treating clinician, lecturer, supervisor, employer, manager, or service provider. The independent person's role is not to give permission for the research; it is to protect the participant's freedom to decide - the participant's own consent remains essential.

An independent person may be needed where:

• the participant is directly dependent on the researcher for care, teaching, supervision, employment, services or support;
• the participant may feel unable to refuse;
• the researcher has a serious conflict of interest (e.g. a financial or career interest in recruitment);
• the study involves vulnerable participants and the relationship may affect voluntariness; or
• refusal may be perceived - even wrongly - as having consequences.

The independent person should be genuinely independent of the relevant power relationship - it is not enough to use a junior colleague from the same team, ward, class, department or reporting line if the participant may still perceive institutional pressure.

8.3 When may an intermediary not be necessary?

An intermediary is not required automatically - the need should be proportionate to the level of risk, dependency and pressure involved. An intermediary may not be necessary where the study is low risk or non-interventional, the participant is not dependent on the researcher, the additional burden is minimal, refusal has no effect on clinical care, employment, education or services, there is no therapeutic misconception, the Information Sheet clearly states that refusal has no consequences, and the participant has time to consider and ask questions. For example, in a near-clinical, non-interventional study using a residual sample (or an extra blood sample taken during an already clinically-indicated procedure), the need for an intermediary may be reduced where the burden is minimal and refusal has no consequence - provided clear written information, explicit reassurance and a simple way to decline are in place.

8.4 Practical questions for researchers

Before finalising your consent process, ask:

• Is the participant dependent on me or my team?
• Could the participant feel obliged to say yes?
• Could refusal be perceived as affecting care, employment, studies or services?
• Is there a conflict of interest in recruitment?
• Would an independent person make the consent process more genuinely voluntary?

If the answer to any of these is "yes", the Information Sheet should include a specific non-consequence statement, and you should consider whether consent ought to be taken by an independent person. Where a power imbalance exists, it is not enough simply to state that participation is voluntary - name the relevant relationship and state clearly that refusal will have no effect on care, treatment, employment, education, assessment, services or institutional relationship, as applicable. This requirement should be applied proportionately: it is not mandatory where there is no meaningful dependency, duress, conflict of interest, or risk that the relationship could control the participant's decision.

9. Focus group confidentiality, adverse events & payment

9.1 Focus group confidentiality

Confidentiality should be explained differently depending on the method used. In a one-to-one interview, confidentiality is mainly under the research team's control - they decide how the recording is stored, who hears it, who transcribes it, how names are removed, how quotations are selected, and how the data are reported. In a focus group, the situation is different: the team can protect the recording, transcript and outputs, but it cannot fully control what other participants may remember or repeat afterwards. This limitation must be made clear before the participant agrees to take part - it would be misleading to say that "all information will be kept confidential" in a group-discussion study. Promise only what the research team can actually control: secure handling of recordings and transcripts, removal of names where possible, careful use of quotations, and non-identification in reports - and be explicit that confidentiality between participants cannot be guaranteed.

9.2 Adverse events and complications in clinical studies

Clinical studies may involve procedures, tests, treatments, devices, sample collection, additional visits or other study-related activities that can cause discomfort, complications or adverse effects. Participants should be told that any adverse events linked to the study will be recorded, assessed and managed appropriately, and what care or support will be available if something goes wrong. This wording is not usually needed for ordinary qualitative studies (interviews, questionnaires, focus groups), but qualitative research can still carry some risk - especially where sensitive subjects such as illness, bereavement, trauma, stigma, discrimination, sexuality, mental health, domestic violence or financial hardship are discussed. In such cases, the Information Sheet should explain what support is available, whether the participant can pause or stop the interview, and whether they can skip any question they prefer not to answer.

9.3 Payment or reimbursement

Describe payment and reimbursement clearly, and distinguish between the two. Reimbursement covers reasonable expenses caused by taking part (travel, parking, agreed out-of-pocket costs) - this is usually acceptable, since participants should not be financially disadvantaged by taking part. Payment means money or another benefit given for participation itself (a fixed fee, voucher, gift card or honorarium) - this may also be acceptable, but it must be proportionate and must not be so high that it pressures someone to take part when they would otherwise prefer not to. Payment must never be presented in a way that hides the burden or risks of the study, and should not be linked inappropriately to completing the whole study if that could discourage withdrawal. Where staged payments are used, the Information Sheet should explain whether the participant will still be paid or reimbursed for the parts already completed if they withdraw - and should always state exactly what will be paid, when, whether expenses are reimbursed, and what happens on withdrawal.

10. Data protection section

This is a legal obligation under the GDPR. The consent form should not try to contain the full data protection explanation - that belongs in the Participant Information Sheet, which should explain what personal data will be collected, why it is needed, who will use it and have access to it, how long it will be kept, whether it will be shared, whether it will be coded, pseudonymised or anonymised, and what rights the participant has.

The consent form should simply confirm that this information has been provided and understood, and point back to the Information Sheet so the two documents work together. Where the study involves special category data - health data, genetic data, biometric data, ethnicity, sex life or other sensitive information - this should be clearly explained in the Information Sheet. The consent form does not need to repeat all the detail, but it should not hide the fact that sensitive data are involved. In short: the consent form confirms the participant's agreement, the Information Sheet carries the detail - don't overload the consent form, but make sure it clearly refers to the Information Sheet and never contradicts it.

11. Where GDPR consent is - and is not - the lawful basis

Consent to take part in research and GDPR consent for data processing are related, but they are not always the same thing. A participant may consent ethically to take part in a study, but the legal basis for processing their personal data may still be something else - public interest, official authority, legal obligation, or legitimate interests. Do not automatically assume that GDPR consent is the lawful basis simply because the participant signs a consent form.

Where GDPR consent is the lawful basis

Use GDPR consent wording only where the controller has decided that the lawful basis for processing is Article 6(1)(a) GDPR and - where special category data are involved - Article 9(2)(a) explicit consent. If GDPR consent is used, the participant must be able to withdraw it, and the wording should make clear that withdrawal does not affect the lawfulness of processing that already took place beforehand. Only use this wording if GDPR consent is genuinely the lawful basis - not simply because the participant is signing a research consent form.

Where GDPR consent is not the lawful basis

Many health and scientific research studies do not rely on GDPR consent as the lawful basis for processing personal data - this is especially common where research is carried out by a public authority, hospital, university or other institution under a public interest, official authority, legal obligation or scientific research framework. In these cases the participant may still be asked to consent to take part as an ethical requirement, but this does not necessarily mean GDPR consent is the legal basis for processing the data.

The consent form should therefore avoid saying "I can withdraw my GDPR consent at any time" - that wording is correct only where GDPR consent actually is the legal basis. Instead, the form should say that the lawful basis and Article 9 condition are explained in the Information Sheet, and that the participant has data protection rights - though some rights may be limited where data have already been anonymised, or where continued use is necessary for scientific research with appropriate safeguards in place. Withdrawal from the study and withdrawal of GDPR consent are not always the same thing: where GDPR consent is not the lawful basis, participants may still withdraw from further participation, but data already collected may sometimes continue to be used where this is lawful, necessary, proportionate and protected by safeguards. This must be explained clearly in the Information Sheet.

12. Secure storage of paper and electronic records

Participants need to know that confidentiality is not just promised, but actually protected in practice. The consent form and Information Sheet should explain how paper records, electronic records, audio recordings, questionnaires, transcripts, sample logs and code keys will be stored.

• Paper records: locked cabinets, restricted offices, limited access, secure archiving.
• Electronic records: password and encryption protection, restricted access, institutional storage systems, audit trails, secure transfer arrangements, role-based access.
• Coded/pseudonymised data: the document linking a participant's identity to their study code should be stored separately from the research data, with access limited to authorised members of the research team - coded or pseudonymised data are still personal data if the participant can be re-identified.

Do not simply write "data will be kept confidential" - explain how: locked storage, restricted access, coding or pseudonymisation, separate storage of identifiers, secure electronic systems, and clear rules on who can access the data.

13. Signatures and the researcher's statement

Participant signature section

The signature records the participant's decision. Date of birth should only be included if it is genuinely needed for identification or eligibility - if not, consider removing it to reduce unnecessary personal data collection.

Participants who are unable to read or sign

A person who cannot read or sign may still be fully capable of giving consent. A witness can confirm that the information was read or explained accurately and that the participant agreed freely. The phrase "unable to read or sign" is more respectful - and broader - than "illiterate".

Statement by the researcher taking consent

The researcher's signature is not a formality - it confirms that the consent process was carried out properly: that the participant was given the Information Sheet and consent form, that the study was explained in a way the participant could understand, that the participant had the opportunity to ask questions, and that those questions were answered. It also confirms that the participant was not pressured, rushed, misled, or made to feel obliged to take part - which matters especially where the researcher is also a clinician, lecturer, supervisor, manager, employer or service provider, or where the participant may feel dependent on the researcher or institution.

The bullet points in this section should never be left as empty "1, 2, 3" placeholders - use them to list, in simple terms, what the participant was told would happen. This helps demonstrate that consent was specific to the actual study procedures. For example:

• The participant will complete one questionnaire lasting approximately [insert time].
• The participant will take part in one audio-recorded interview lasting approximately [insert time].
• A blood sample will be taken during a routine clinical visit.
• Relevant clinical data will be collected from the medical record.
• Study data will be coded and stored securely for [insert period].
• Remaining samples/data may be used for future ethically-approved research in the same or a related field, where applicable.

Final rule: the consent form should be short, clear and specific. The Information Sheet carries the detail - the consent form simply records the participant's informed agreement.