Informed Consent and Data Protection: Two Different Documents

Informed consent and data protection are two different documents. Informed consent is the patient’s agreement to an action affecting their health, and it is regulated by Spain’s Law 41/2002. The legal basis for processing their data while treating them is not their consent; for some other purposes, such as sending them advertising, the AEPD (the Spanish Data Protection Agency) states that you do have to ask for it.

Two documents governed by two laws

Informed consent and consent to process data are similar in name and in little else. The first is defined by Law 41/2002 (Spain’s patient autonomy law) as “the free, voluntary and conscious agreement of a patient, expressed in the full use of their faculties after receiving appropriate information, for an action affecting their health to take place”.

The second is defined by the General Data Protection Regulation (GDPR) as any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify, by a statement or by a clear affirmative action, agreement to the processing of personal data relating to them. One looks at the healthcare action; the other, at what is done with the data.

Difference	Informed consent	Consent to process data
What it authorises	An action within the scope of the patient’s health.	Processing of their data for one or more specific purposes.
Where it is regulated	In Law 41/2002, on patient autonomy.	In the GDPR and the LOPDGDD (Spain’s data protection and digital rights law).
When it is needed	For any action in the healthcare field, as a general rule.	Only when the processing relies on it; the AEPD gives sending advertising as an example.
Form	Verbal as a general rule; in writing in the cases set by law.	A statement or a clear affirmative action; with health data, explicit consent.
If the patient changes their mind	They can freely revoke it in writing at any time.	They can withdraw it at any time, without affecting what was done before.

We explain which actions need written consent and how to sign it without paper in signing consent forms on a tablet.

To treat the patient, the legal basis is not their consent

When you treat a patient, what allows you to process their health data is not their consent. The GDPR prohibits processing data concerning health except in the cases of its Article 9.2, and explicit consent is only one of them, point (a). A different one, point (h), covers processing necessary for medical diagnosis or the provision of health care or treatment, when carried out by a professional subject to professional secrecy or someone under their responsibility, or another person also subject to secrecy.

In Spain, the seventeenth additional provision of the LOPDGDD declares that the processing of health data regulated in several laws, including Law 41/2002 itself, is covered by points (g) to (j) of that article. And the AEPD, in its guide for patients and healthcare users, puts it bluntly: it is not necessary for the doctor or the healthcare centre to ask patients for consent to collect and use their health data if they are going to be used for medical diagnosis or the provision of healthcare.

What you do have to do is tell the patient who processes their data, what for and what rights they have; we cover this in how to inform patients about their data. If your centre is not a healthcare one, the basis may be a different one: check with your adviser.

When consent for data is needed

There are uses of data that are not treating the patient and that do need their consent. The AEPD guide gives an example from the consulting room: consent must be requested if the dentist or the physiotherapist wants to send advertising. In a clinic, that affects uses such as these:

• Sending promotions or commercial news from the clinic.
• Using patient photos on social media, on the website or in leaflets. To process health data on that basis, the GDPR speaks of explicit consent for one or more specified purposes; we explain this in before-and-after patient photos.

When the processing relies on consent, the GDPR sets conditions:

• the clinic must be able to demonstrate that the patient consented;
• if the request is made in a document that also deals with other matters, it must be clearly distinguishable from them;
• the patient can withdraw it at any time, and withdrawing it must be as easy as giving it.

And the LOPDGDD adds that performance of a contract cannot be made conditional on the patient consenting to the processing of their data for purposes unrelated to the maintenance, development or control of the contractual relationship.

Typical mistakes when mixing them up

These mistakes have one thing in common: they lump together what the law keeps apart.

1. A single form with a single signature for everything. Consent to treatment, data protection information and advertising authorisation serve different functions. If a request for consent to process data is in a document with other matters, the GDPR requires it to be clearly distinguishable.
2. Calling the data protection information “consent”. It confuses the patient: the GDPR allows them to withdraw at any time whatever relies on their consent, whereas the medical record must be kept regardless, for at least five years from the discharge date of each care process.
3. Assuming informed consent covers photos on social media. It authorises the healthcare action, not advertising.
4. Making care conditional on accepting advertising. That is exactly what the LOPDGDD does not allow: making the contract conditional on consent for purposes unrelated to it.
5. Being unable to demonstrate marketing consent. If it is not signed and stored, demonstrating that the patient consented becomes complicated.

How Mi Clínica keeps them separate

In Mi Clínica each one is a separate document. Consents come in four types: consent to treatment, data protection, photography authorisation and marketing authorisation. Consent to a treatment is stored linked to that treatment. They are signed on the tablet, and the signature is stored as evidence that cannot be modified.

With photos, the separation is enforced by the program:

• every photo that is uploaded is private by default, and the record shows it as “Privada clínica” (private, clinical use);
• to use it in marketing, the patient’s signed marketing consent is required: it is never inferred from the clinical photo.

What Mi Clínica does not decide is what each use of your patients’ data relies on: that is a matter for the clinic and its adviser. How documents and signing work is summarised in documents and signing (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Guía para pacientes y usuarios de la Sanidad. AEPD.