Because the expedited IRB review process is generally used for certain types of minimal risk research, it is less stringent than review by the full IRB.

Greater than minimal risk studies require full committee review, while minimal risk studies may be eligible for expedited review or exempt certification.

Expedited Research These categories involve collection of samples and data in a manner that is not anonymous and that involves no more than minimal risk to subjects.

OHRP policy provides that any institution with an OHRP-approved Assurance may use expedited review for initial or continuing review of HHS-supported or conducted research and for review of minor changes in previously approved research as described in 45 CFR 46.110(b)(2).

In an emergency, a doctor must act quickly to save a life. If stopping life-saving efforts and describing the risks of a procedure will cause a delay that puts the patient’s life further at risk, then the doctor does not need to obtain informed consent. The patient is mentally incapacitated or emotionally fragile.

What is ‘freely given’? Consent means giving people genuine choice and control over how you use their data. If the individual has no real choice, consent is not freely given and it will be invalid.

If in doubt, we recommend you consider refreshing consent every two years – but you may be able to justify a longer period, or need to refresh more regularly to ensure good levels of trust and engagement.

If an adult lacks the capacity to give consent, a decision about whether to go ahead with the treatment will need to be made by the healthcare professionals treating them. To make a decision, the person’s best interests must be considered.

The law provides six legal bases for processing: consent, performance of a contract, a legitimate interest, a vital interest, a legal requirement, and a public interest. First, most organizations ask if they have to have consent to process data.

You must have a valid lawful basis in order to process personal data. There are six available lawful bases for processing. No single basis is ‘better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual.

Data protection lawyer Dai Davis, of Percy Crow Davis & Co law firm, says: “Organisations simply need to comply with the GDPR (or at least try to). In any event, there is no certifying body. You don’t need to prove compliance… you simply have to be compliant.”