Withdrawing informed consent: what to do

Can informed consent be withdrawn? Yes: Spain's Ley 41/2002 (the basic law on patient autonomy and clinical documentation) says that the patient can freely withdraw their consent in writing at any time. For the clinic, that means collecting the withdrawal in writing, keeping the signed document and the withdrawal together, informing the practitioner and reviewing the pending appointments for that treatment.

What the law says

Withdrawal is a right of the patient, and the law puts it in a single sentence. Article 8 of Ley 41/2002, the basic law on patient autonomy, says that “the patient may freely withdraw their consent in writing at any time” (translated from the Spanish).

Three useful ideas for reception come out of that sentence:

• “Freely”. The decision belongs to the patient, not the clinic.
• “In writing”. That is the form the law sets. If the patient says it verbally, it is best that they put it in writing, even if only in a signed note at reception.
• “At any time”. Before starting or midway through a multi-session treatment.

Withdrawal fits with the principles of the same law: the patient has the right to decide freely, after receiving adequate information, between the available clinical options, and every professional involved in care is obliged to respect the decisions freely and voluntarily taken by the patient. That is why the document itself should remind the patient of this right, as we explain in what an informed consent form should include.

Withdrawing, refusing and not wanting to know: three different things

Withdrawing is not the same as refusing a treatment or waiving information, even though at the front desk they look alike. The law treats them separately, and consent to data processing has its own rule as well:

What the patient does	What the rule says	How it is recorded
Withdraws a consent already given	May withdraw it freely at any time (Ley 41/2002, Article 8)	In writing
Refuses a treatment	Has the right to refuse treatment, except in the cases set out in the law (Ley 41/2002, Article 2)	The refusal is recorded in writing
Does not want to be informed	Their wish is respected, within the limits of the interest of their own health, of third parties or of the community, and the therapeutic requirements of the case (Ley 41/2002, Article 9)	Their waiver is documented, without prejudice to obtaining their prior consent for the intervention
Withdraws consent for their data to be processed	Has the right to withdraw it at any time (GDPR, Article 7)	Withdrawing it must be as easy as giving it

Telling them apart matters because each leaves a different record in the file. A patient who does not want to know the details of their treatment has not withdrawn anything, and one who withdraws a marketing consent has not stopped consenting to their treatment.

What to do when a patient withdraws consent

The first thing is to respect the decision and document it properly. A practical order for reception and for the practitioner:

1. Collect the withdrawal in writing, with the date and the signature of the patient or their representative. If it arrives by email, keep it and, when they come to the clinic, ask them to sign it.
2. Do not delete or alter the signed consent. It is the proof of what the patient authorised and when; the withdrawal is added to it, it does not replace it.
3. File it with the document it withdraws, in the patient's documentation, so that whoever looks at it sees both.
4. Inform the practitioner in charge of the treatment before the next appointment.
5. Review future appointments for that treatment and cancel or change them according to what the patient decides.
6. If they want to resume the treatment, prepare a new consent and do not reuse the withdrawn one.

If the withdrawal arrives midway through a treatment, the consequences of stopping and how to explain them to the patient are a matter for the practitioner, not reception.

What does not change: what was done and the medical record

Withdrawal looks forward: it removes the authorisation for what remains to be done. What has already been done was done with a valid consent, and the document that proves it is still needed.

The medical record does not disappear either. Ley 41/2002 says that healthcare centres are obliged to keep clinical documentation for the period appropriate to each case and, as a minimum, five years from the date of discharge of each episode of care; the details are in how long the medical record must be kept.

That is why the prudent course is to keep the original consent and the withdrawal together: between them they explain what the patient authorised, until when and from when they stopped authorising it.

If what they withdraw is their consent for data or photos

When what the patient withdraws is consent to process their data, the rule is the GDPR's: the data subject has the right to withdraw consent at any time, and withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

The same article adds two details that affect how consent is requested: before giving consent, the data subject must be informed of that right, and it must be as easy to withdraw consent as to give it. If the patient authorised with a signature at reception, withdrawing it should not require more steps than that.

In addition, the GDPR recognises the right to erasure of data when the data subject withdraws the consent on which the processing is based and there is no other legal ground for it. That is not the case for care data, which rest on a basis other than consent, as we explain in informed consent and data protection.

Two typical cases in a clinic:

• Marketing. Stop sending promotions from the day they withdraw, and record the date.
• Photos on social media or the website. Stop using them and take them down wherever they have been published. A person's image also has its own protection, which we cover in before-and-after photos of patients.

What Mi Clínica stores and what the clinic does

In Mi Clínica what is signed is kept as it was signed, which is exactly what you need when a patient withdraws consent:

• The signed document is not touched. The signed file cannot be modified.
• Versions, not crossings-out. If the patient consents again later, a new version of the consent is made and the previous one is kept intact, with its signature.
• Signature trail. A log records who registered the signature of each consent.
• Photos private by default. Each photo uploaded to the file is stored as private to the clinic.

The withdrawal is noted on the signed consent itself: “Anotar una revocación recibida por otro medio” (Record a withdrawal received by other means) marks it as “Revocado” (Withdrawn) without touching the signature, records in the activity log how and when it was withdrawn, and appointments stop showing that consent; if it is the marketing consent, the photos authorised for marketing become private again. What the program does not do: remove anything from the clinic's social media or website. The team decides and does that, with the patient's written statement in hand. Mi Clínica does not certify compliance with any regulation either: it helps ensure that what was signed is stored and easy to find. A summary of documents and signatures is on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).