Patient Information and Consent

Consent sits at the heart of respectful privacy and should be informed, voluntary and recorded; while not every data flow requires consent under GDPR, common law will often expect it where sharing falls outside direct care. ^[2][6]

Types of consent

Implied consent generally supports sharing within the care team for direct care where patients can reasonably expect it. ^[4][2]

Explicit consent is needed where information will be shared beyond care teams, with non-essential third parties, or for publication and teaching if there is any risk of identification. ^[3][2]

Making consent valid

Consent is more likely to be valid when the purpose, recipients and risks are explained in plain language, when real choices are offered and refusals are respected unless law or serious risk justifies disclosure, and when preferences are recorded with dates and review points so everyone is clear about scope and limits. ^[5][2][6]

• Recording tools that work: use consent fields in the PMS, scanned forms, or tight templates that capture who obtained consent, the scope agreed, any expiry or review, and specific exclusions. ^[2][1]
• Safety-netting: note how consent can be withdrawn and who to contact, and confirm that care is unaffected where patients decline non-essential sharing. ^[2][5]

Families, carers and friends

Checking with the patient before discussing their details with others preserves autonomy; capturing named contacts and the agreed scope of their involvement gives a clear record, and where capacity fluctuates it is sensible to confirm consent each time if there is doubt so that assumptions do not creep in. ^[1][7]

Capacity and best interests

When an adult lacks capacity for a specific decision, share only what is necessary in their best interests, following national capacity law and local policy; involving people who know the patient well, where appropriate, and recording the decision-making steps helps keep the process transparent and reviewable. ^[7][5]

Children and young people

Assessing competence guides the approach to consent; where a child is not competent, those with parental responsibility are usually asked to decide unless safeguarding considerations change the balance, and recording who gave consent, what was agreed and any limits keeps the file complete. ^[8][5]

Transparency with patients

A concise privacy notice that explains how data are used, the rights patients have, and who to contact with concerns supports understanding, and offering large-print or easy-read versions on request improves accessibility. ^[9]

References (numbered in text) Why we include references

1. Disclosing confidential information — General Optical Council Find (opens in a new tab)
2. Consent — Information Commissioner's Office (ICO) Find (opens in a new tab)
3. What is valid consent? — Information Commissioner's Office (ICO) Find (opens in a new tab)
4. Implied consent / Information: to share or not to share — Health Research Authority Find (opens in a new tab)
5. Decision making and consent — General Medical Council (GMC) Find (opens in a new tab)
6. Confidentiality: NHS Code of Practice — Department of Health and Social Care Find (opens in a new tab)
7. Decision-making and mental capacity (NICE guidance NG108) — National Institute for Health and Care Excellence (NICE) Find (opens in a new tab)
8. Consent to treatment — Children and young people — NHS Find (opens in a new tab)
9. How to write a privacy notice and what goes in it — Information Commissioner's Office (ICO) Find (opens in a new tab)