Consent for processing health data
In short
It is the expression of will by which a person authorizes the collection, use or sharing of their health data for specified purposes. The GDPR and the LGPD set stricter requirements for it than for other data: it must be explicit under the GDPR, or specific and highlighted under the LGPD. But it is not the only legal basis: the GDPR, HIPAA and the LGPD provide their own bases for care without consent.
- Type
- Concept
- Steward
- No single steward: general concept or generic technology
- Reviewed
- October 25, 2026
Explanation
What it is
In data protection, consent is a legal basis for processing personal data. Under the GDPR it is a freely given, specific, informed and unambiguous indication of wishes, by a statement or by a clear affirmative action (Art. 4(11)). It should not be confused with:
- Clinical informed consent, which authorizes a medical procedure.
- Consent management, the practice and technology that record and enforce those decisions.
Requirements by jurisdiction
| Jurisdiction | When it is asked for | Requirements and alternatives |
|---|---|---|
| European Union (GDPR) | One of the Art. 9(2) exceptions (point a) | Explicit and for specified purposes; withdrawable at any time (Art. 7(3)); the controller must be able to demonstrate it (Art. 7(1)). There are other bases, such as health care (point h) |
| United States (HIPAA) | Authorization for uses outside treatment, payment and operations (§ 164.508) | Not required for treatment, payment and operations; obtaining consent is optional (§ 164.506) |
| Brazil (LGPD) | Art. 11(I) | Specific and highlighted, for specific purposes; Art. 11(II) lists cases without consent, such as health protection |
| Canada (PIPEDA) | Principle 3 of Schedule 1 | Knowledge and consent, except where inappropriate; the OPC published guidelines with seven guiding principles for meaningful consent |
| Argentina (Law 25,326) | Art. 7 | Nobody can be obliged to provide sensitive data; Art. 8 allows health establishments and professionals to process their patients' data |
Opt-in or opt-out
Some laws do not ask for consent but grant a right to object. The European Health Data Space lets Member States provide for an opt-out from access for primary use (Art. 10) and gives people the right to opt out of secondary use at any time and without giving reasons (Art. 71).
Common misconceptions
- Believing consent is always the right basis. Under the GDPR it can be withdrawn at any time (Art. 7(3)), and Article 9(2) offers other bases for care and public health.
- Believing care is impossible without consent. The GDPR, HIPAA and the LGPD provide bases for care.
- Confusing opt-out with consent. For EHDS secondary use, silence does not amount to a refusal; and even after an opt-out, a Member State may provide for the national mechanism of Art. 71(4) for certain public health purposes or scientific research for important reasons of public interest, at the request of public sector bodies or bodies with a public health mandate.
- Asking for blanket consent. The GDPR and the LGPD require specified or specific purposes.
Usage examples
In the EU, a study based on explicit consent (GDPR, Art. 9(2)(a)) must make withdrawing it as easy as giving it (Art. 7(3)).
In the United States, a covered entity needs the patient's written authorization for uses that HIPAA does not permit without it (§ 164.508).
In Brazil, consent to process health data must be given in a specific and highlighted manner (LGPD, Art. 11(I)).
In Canada, PIPEDA Principle 3 requires knowledge and consent, and its note recognizes that medical reasons can make it impractical.
In the EU, the EHDS gives people a reversible right to opt out of the secondary use of their electronic health data (Art. 71).
In Argentina, Article 7 of Law 25,326 states that nobody can be obliged to provide sensitive data.
Relation to other terms
Relies on1
- Health data protectionStrong
Consent is one of the legal bases that health data protection laws regulate; its requirements depend on those laws.
Depend on this one1
- Consent managementMedium
Consent management records and enforces decisions whose legal effect is set by the rules on consent for processing health data.
Sources
- EUR-Lex — Regulation (EU) 2016/679 (GDPR)eur-lex.europa.eu
- EUR-Lex — Regulation (EU) 2025/327 on the European Health Data Spaceeur-lex.europa.eu
- eCFR — 45 CFR Part 164 (HIPAA Privacy Rule, §§ 164.506 and 164.508)ecfr.gov
- Planalto — Lei nº 13.709/2018 (LGPD), texto compiladoplanalto.gov.br
- Office of the Privacy Commissioner of Canada — Guidelines for obtaining meaningful consentpriv.gc.ca
- Argentina.gob.ar — Ley 25.326 de Protección de los Datos Personalesargentina.gob.ar