If you are involved in an active research study sponsored by the University of Edinburgh and/or NHS Lothian, you must provide transparency information to participants about the legal basis and other details of processing their personal data.

The Health Research Authority (HRA) has produced recommended wording to fulfil transparency requirements under UK GDPR for health and care research, and ACCORD has used this information to draft templates to be used by research teams.

It's important that you explain to your participants how you will be using their personal data and what their rights are under the law.  To do this, please identify the situation below that is relevant to your study, noting that more than one scenario may apply for different participants. The scenarios below only apply to collection and/or processing of personal data.

You do not need to amend existing Participant Information Sheets (PIS) or submit amendments for approval.  You can provide transparency information to existing research participants in a separate stand-alone document from the PIS. Any changes to study documents to update references from previous legislation (i.e. Data Protection Act 1998) to new legislation are classified as non-substantial, non notifiable amendments.

Contact your Sponsor Representative for a PIS template and GDPR specific wording before submitting for approvals.  ACCORD will revise the PIS template shortly with GDPR specific wording.

Use the stand-alone ACCORD GDPR Participant Information template, deleting sections not relevant to your study to provide transparency information to new participants.

If personal data are still being collected, provide transparency information to these participants when data is next collected directly from them (or sooner if you have other contact).  Use the stand-alone ACCORD GDPR Participant Information template, deleting sections not relevant to your study, to provide transparency information to the participants.

There is no need to re-consent existing participants when providing them with the new transparency information. 

If there will be no further contact with participants, but personal data is still being collected (e.g. obtaining existing data from an NHS organisation) or being processed, consider how to provide the transparency information through other means.  Options for dissemination include in appointment and clinic letters, providing at the participant's next study visit,organisation/unit/study websites, social media, posters and leaflets in clinics and study-specific materials. Use the wording in the stand-alone ACCORD GDPR Participant Information template, deleting sections not relevant to your study, to provide transparency information to participants by other means.

Even if participants have completed the study, you may still be processing personal data if you are storing information that is identifiable or could be identified. You should not access names or contact details by breaking a code solely to provide transparency information. Consider how to provide the transparency information through other means, including via organisation/unit/study websites. If such sites are unlikely to be accessible to participants, contact your Sponsor Representative as detailed in your protocol to discuss possible exemptions.

The stand-alone GDPR Participant Information is classed as a non-substantial, non-notifiable amendment, and can simply be implemented. This amendment cannot include anything other than this stand-alone GDPR Participant Information. You should then include your implemented amendment along with any future amendment submitted for approvals.

Once you have implemented your study specific GDPR Participant Information, please confirm implementation by e-mail to resgov@accord.scot.  Title the email ‘IRAS CODE XXXXXX:  Implementation of Study Specific GDPR Participant Information’ and state clearly in the e-mail the Chief Investigator's name, the study title and that you confirm implementation of this non-substantial/non-notifiable amendment at site(s). Don't panic. This did not have to be completed by 25 May 2018. If we do not hear from you though, we will follow up to confirm implementation.

If you require any assistance or have any questions, please contact your Sponsor Representative as detailed in your protocol, or email enquiries@ACCORD.scot.