Consent on a Screen: The Regulatory Anatomy of eConsent
Why electronic informed consent sits across electronic signature, data protection and GCP / ethics — all at once — and why acceptance is not universal.
REGULATORY OPERATIONSeConsent is not a paper form on a screen: one signature engages three regulatory perimeters at once, and a gap in any one can invalidate the consent and the participant's data.
Signature binding, remote identity and comprehension, and country-by-country acceptance must be designed in before go-live, not assumed from a tablet and a tick-box. Run the three-perimeter assessment in the RIA, map signature acceptance per country and per signer, bind every signature to a document version, and set the data-processing basis separately from the research consent.
One eConsent signature sits inside three perimeters at once, and each has its own rulebook
| Perimeter | What it requires | Common pitfall |
|---|---|---|
| Electronic signature | Bound to the right person and version, with audit trail; Part 11 in the US, the eIDAS tier national law requires in the EU | A "mark" that does not manifest signer, time and meaning, or is not version-bound |
| Data protection and privacy | A lawful basis, transparency, and a distinction between research consent and the processing basis | Treating research consent as the data-processing basis — they are not the same |
| GCP / ethics | Ethics-approved content and process, version control, documented comprehension and re-consent | Informal re-consent after an amendment, with no record of who saw which version |
Four positions that separate a valid eConsent from a form on a tablet
Under 21 CFR Part 11 a signature manifests signer, date and time, and meaning, linked to the record (§§11.50, 11.70). Process audit trail, version control, re-consent and withdrawal all attach to it.
Art. 29(1) requires consent "written, dated and signed" and says nothing about electronic form. Belgium requires an advanced or qualified eIDAS signature, the Czech Republic a qualified one, Greece's ethics committee wet ink.
Without a person in the room, identity cannot be assumed from physical presence and comprehension loses face-to-face cues — knowledge checks and the impartial witness (ICH E6(R3) s.2.8.9; CTR Art. 29(1)) fill the gap.
The two are distinct and both must be addressed; identity and biometric verification data carry their own obligations (GDPR Art. 9(1); Art. 35 where large-scale).
Six controls, one per trigger that raises the eConsent weight
- 1Deliver a Part 11 signature manifesting signer, time and meaning, bound to the document version — the eIDAS tier national law requires in the EU.
- 2Design identity and comprehension into the remote path: ID verification, a knowledge check and, where needed, a remote witness; record the process.
- 3Make re-consent a controlled workflow on every amendment, with version-bound signatures and an audit trail of who saw which version.
- 4Map acceptance per country and per signer before go-live; provide a wet-ink path and the required signature tier where a jurisdiction demands it.
- 5Build assent and representative-consent flows where minors or legally designated representatives are enrolled (CTR Arts 31–32; 21 CFR 50 Subpart D).
- 6Set the lawful basis and transparency for identity data separately from the research consent; minimise and protect it (QPP-02).
21 CFR Part 11 and 21 CFR 50.27 · FDA/OHRP eConsent Q&A (Dec 2016) · FDA Part 11 Q&A (Oct 2024) · EU CTR Arts 28(3), 29(1), 31–32 · eIDAS 910/2014 as amended by 2024/1183 · HMA/EC/EMA Recommendation paper V02 (1 Oct 2025) · EMA/INS/GCP/112288/2023 Annex 5 · ICH E6(R3) s.2.8 · HRA/MHRA statement (2018) · GDPR Art. 9(1)
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call