The question the filing cabinet could not answer
A dental clinic keeps every signed consent form in a cabinet behind reception. Roughly four thousand of them. A supervisory authority asks a narrow question: for one named patient treated in 2023, which version of the consent text was that patient shown?
The clinic has the signed page but not the answer. The wording had been edited twice since, once to add a paragraph about photographs, and nobody recorded which revision was on the counter in March 2023. The signature is there and proves almost nothing. That gap is worth fixing, but a more common mistake sits on the same sheet of paper.
Two consents, one form
Most clinic consent forms do two jobs at once, and most guidance blurs them together.
The first is consent to treatment: a medical and ethical act, grounded in civil law and bodily autonomy. The patient is told what will be done to their body and agrees.
The second is a legal basis for processing health data under the GDPR, a question about records, storage and disclosure.
Different legal instruments. For clinical trials, the European Data Protection Board and the European Commission have both stated that informed consent to participate must not be confused with consent as a legal ground for processing personal data, describing them as two different levels: protection of integrity and self-determination on one side, protection of data on the other. The same reasoning applies in ordinary practice, so a form can carry a valid treatment consent while the data processing rests on something else. Usually it does.
For direct care, the basis is Article 9(2)(h)
Health data is a special category, and processing it is prohibited unless an exception in Article 9(2) applies. For a clinic delivering care, the relevant one is normally point (h):
processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3
Article 9(3) adds the condition: the data must be processed by or under the responsibility of a professional subject to an obligation of professional secrecy. A clinic whose clinicians are bound by that, operating under national health law or under contract with the patient, is inside the exception.
Note what is absent. No tick-box. No signature. The basis exists because of what the clinic is and what it does.
Why consent is structurally the wrong basis for the care record
This is not a stylistic preference. Consent breaks if you use it here. Article 7(3) says the data subject "shall have the right to withdraw his or her consent at any time" and that "it shall be as easy to withdraw as to give consent." If consent were the basis for the clinical record, a patient withdrawing it would oblige the clinic to stop processing that record. But the record must be kept for a period set by national law. The clinic cannot do both.
A legal basis that collapses the moment it is exercised was never a real one. Article 9(2)(h) exists so the care record does not depend on continuing permission. There is a second problem. As a general principle in EU data protection guidance, where the data subject is in a situation of dependency, institutional, hierarchical, or simply because they are not in good health, consent will often not be the appropriate legal ground. A patient in a treatment chair is not well placed to say no to the person about to treat them.
Where explicit consent genuinely belongs
Everything outside direct care is different. Marketing, website photographs, teaching images, optional research: none are necessary for treatment, so Article 9(2)(h) does not reach them. For those, the basis is Article 9(2)(a):
the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject
Here the paperwork matters, because Article 7(1) puts the burden on the clinic: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented."
Article 7(2) governs how it is asked. The request must be "presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language." One consent covering treatment, marketing and teaching photographs in a single sentence fails that. Recital 32 adds that consent requires a clear affirmative act, and that silence, pre-ticked boxes or inactivity do not constitute consent.
So: separate boxes, per purpose, unticked, in plain wording.
Mapping a real clinic form
| Item on the form | Correct legal basis | Evidence you need |
|---|---|---|
| Clinical history, diagnosis, treatment notes | Art 9(2)(h), with the Art 9(3) secrecy condition | Nothing signed by the patient for the basis itself |
| Consent to the procedure | Medical and civil law act, not a GDPR basis | Who signed, which version of the text, when |
| Retention after treatment ends | Art 9(2)(h) plus national retention law | The retention rule documented, not patient permission |
| Marketing emails and newsletters | Art 9(2)(a) explicit consent | A separate unticked box, plus proof under Art 7(1) |
| Photographs for teaching, publication or commercial use | Art 9(2)(a) explicit consent | A separate box per use, purpose stated specifically |
| Optional research participation | Art 9(2)(a) explicit consent | Its own box, withdrawable without affecting care |
Read down the right-hand column. For the care record the clinic needs a defensible position, not a signature. For the optional items it needs a demonstrable record of a specific choice. Which items on your own form fall on which side is not answerable from a template: it depends on what the clinic does with the data, what national law says, and how the form is worded today.
What the signature is actually for
Once the legal basis is settled, the signature has a clearer job. It is the evidence layer, proving three things: who signed, which version they were shown, and when. That serves the treatment consent, a clinical and legal record in its own right, and the Article 7(1) duty on the optional items. On legal effect, eIDAS Regulation (EU) 910/2014 Article 25(1) is direct:
An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures.
No signature level is harmonised across the EU as mandatory for patient consent. What matters evidentially is identity, document version and timestamp. Which level to use depends on national law and the clinic's risk assessment, much as mixing signature levels in a multi-party contract turns on the governing law rather than a universal rule.
Building the form so the evidence exists
Separate boxes per purpose. A template with positioned checkbox fields, grouped where that makes sense, is what Article 7(2) granularity looks like in practice. Marketing and teaching photographs get their own boxes, ticked independently.
Sign at the counter, not by email. A signer can be routed to a tablet at the clinic instead of an email link, and then has no email address recorded at all. That is data minimisation applied to the field clinics most often collect out of habit. The tablet is bound to a station, and each session closes before the next patient starts.
Keep the audit trail with the document. Per signer it holds when they were notified, first and last viewed it, the link access count, when they signed, the IP address, the user agent, and the SHA-256 hash of the original and signed file. A signed PDF can be looked up by its hash to find its envelope, which is how you show the file in front of a regulator is the file the patient saw.
Pick the level deliberately. A simple signature is applied server-side with the platform certificate in PAdES-B-B form, and the envelope is closed with a cryptographic seal. For a routine consent given in person, that is often proportionate. Where identity should be established rather than assumed, the advanced option adds an identity document check plus a face and liveness check before signing.
That is the answer the filing cabinet did not have. This article is general information about the Regulation and not legal advice for any specific clinic.
Frequently asked questions
Do we need patient consent under GDPR to keep medical records? Normally no. For the provision of care, Article 9(2)(h) is the usual basis, subject to the Article 9(3) condition that the data is handled by or under the responsibility of someone bound by professional secrecy. Consent to treatment is a separate act and does not double as the data protection basis.
What is the difference between consent to treatment and GDPR consent? Consent to treatment concerns bodily autonomy and belongs to medical and civil law. GDPR consent under Article 9(2)(a) is a ground for processing data. Clinical trials guidance calls them two different levels, and the same distinction applies in ordinary practice.
Can a patient withdraw consent and force us to delete their clinical record? If the record rests on Article 9(2)(h) rather than consent, there is no consent to withdraw, and national law sets a retention period the clinic must respect. Withdrawal under Article 7(3) applies to items that genuinely rest on consent, such as marketing or photographs.
Which parts of a clinic consent form need explicit consent? The parts not necessary for care: marketing, teaching or publication images, commercial photographs, optional research. Article 7(2) requires each to be presented distinguishably in plain language, and Recital 32 rules out pre-ticked boxes and silence.
Is an electronic signature valid on a patient consent form in the EU? Article 25(1) of eIDAS states an electronic signature cannot be denied legal effect or admissibility solely because it is electronic or not qualified. No level is harmonised across the EU here, so the choice depends on national law and the clinic's risk assessment.
How do we prove which version of the form a patient signed? By storing the hash of the signed document with the audit trail. A SHA-256 hash of the original and the signed file, plus the timestamps for that signer, shows a specific patient signed a specific version on a specific date. A paper file cannot.
Working out which items on your consent form need their own explicit consent? Talk to us.