The HRA expects those with a study that was in progress at 25 May 2018 to have changed their wording. There is no requirement for those who have adopted the original wording published in May 2018 to further amend their text, unless they wish to do so (in which case it will be regarded as a non-notifiable amendment as previously and does not need to be submitted to HRA). The wording below is therefore for new studies and will help sponsors to avoid being asked to make changes to participant information during approval.
Instructions for use
It is expected that somewhere in the Participant Information Sheet (PIS), the name of the sponsor organisation is given. It should therefore be clear to readers that any reference to ‘we’ means the sponsor and not the local site. As appropriate you should reinforce who ‘we’ refers to as readers are likely to assume that the site is the only organisation involved in the study.
We recommend that you provide information in a layered way so that potential participants can access the level of information they wish. The information below should be included as part of wider study/ research information. The summary PIS provides brief information, the main PIS provides more information for those who are interested in taking part. The template wording for generic information document webpage provides more technical information that all studies should refer to, either by providing a document or leaflet in paper form, or by linking to the website, as appropriate to the study and participants.
Text in bold is instructions. Text in [square brackets] should be used as relevant. Terms such as NAME, OTHER, X or EVENT should be replaced with the relevant words.
This guidance and the accompanying generic text is compatible with the opinion published (23 January 2019) by the European Data Protection Board (EDPB) on the interplay between the clinical trials regulation and GDPR.
In the summary PIS
We recommend that potential participants are provided with a summary sheet that provides a simple outline of the study. If you use such a summary the text about use of personal data should be kept brief and simple.
In this research study we will use information from [you] [your medical records] [your GP] [OTHER]. We will only use information that we need for the research study. We will let very few people know your name or contact details, and only if they really need it for this study.
Everyone involved in this study will keep your data safe and secure. We will also follow all privacy rules.
At the end of the study we will save some of the data [in case we need to check it] AND/OR [for future research].
We will make sure no-one can work out who you are from the reports we write.
The information pack tells you more about this.
In the PIS or document provided to participants
How will we use information about you?
We will need to use information from [you] [from your medical records] [your GP] [OTHER] for this research project.
This information will include your [initials/ NHS number/ name/ contact details/ provide a bullet list of identifiers held by site and/or sponsor for the research]. People will use this information to do the research or to check your records to make sure that the research is being done properly.
OPTION where applicable: People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead.
We will keep all information about you safe and secure.
OPTION where applicable: Some of your information will be sent to [country X]. They must follow our rules about keeping your information safe.
Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study.
What are your choices about how your information is used?
- You can stop being part of the study at any time, without giving a reason, but we will keep information about you that we already have.
- OPTION if follow up data will be collected after withdrawal: If you choose to stop taking part in the study, we would like to continue collecting information about your health from [central NHS records/ your hospital/ your GP]. If you do not want this to happen, tell us and we will stop.
- We need to manage your records in specific ways for the research to be reliable. This means that we won’t be able to let you see or change the data we hold about you.
- OPTION if data will be used for future research: If you agree to take part in this study, you will have the option to take part in future research using your data saved from this study. [Insert details of any specific bank/ repository]
Where can you find out more about how your information is used?
You can find out more about how we use your information
- at www.hra.nhs.uk/information-about-patients/
- our leaflet available from [X]
- by asking one of the research team
- by sending an email to [email], or
- by ringing us on [phone number].
NOTE: At least one of these sources must be able to point people directly to the sponsor’s Data Protection Officer.
For [X] sponsors can either provide the HRA link: www.hra.nhs.uk/patientdataandresearch or if this is available on sponsor website, the sponsor may choose to include their own website link.
Communicating GDPR information to children and young people
You must provide children with the same information about what you will do with their personal data as you would give to adults. Even where you're seeking consent from a parent or guardian, there is an expectation that you give children information about what you'll do with their personal data. You can view the guidance from the Information Commissioner's Officer (ICO) for further information.
Article 12 of the GDPR states that information provided to individuals should be in a concise, transparent, intelligible and easily accessible form, using clear and plain language. This is particularly important for any information addressed specifically to a child, as this allows them to be as involved as possible in any consent decision.
The HRA has partnered with the Penta Foundation, University College London and UK Research and Innovation MRC Clinical Trials to create an engaging and age-appropriate GDPR resource for children and young people. This resource is intended to help them understand what will happen to their personal data if they take part in a research study. The HRA recommends that sponsors use this resource as the basis for any GDPR information provided to children as part of the consent process for taking part in research.