Psychological research often involves the collection and processing of personal data from human research participants, and there is a norm that informed consent should be obtained before such research can go ahead. The European General Data Protection Regulation (GDPR) applies, in principle, to psychological research. It elaborates a range of conditions concerning the forms of information which should be communicated to research participants whenever personal data are collected from them, in order that they might be considered to be ‘informed’. There is reason to believe, however, that the information required by the GDPR may not always be provided in consent materials. This may – at least in part – be due to the fact that psychological researchers are not aware of the exact requirements. This tutorial thus aims to provide general practical guidance to psychological researchers allowing them to understand which forms of information must be provided to research subjects in consent materials according to the GDPR.

In many instances, psychological research requires the collection and processing of personal data collected directly from research subjects. In principle, the General Data Protection Regulation (GDPR) applies to psychological research which involves the collection and processing of personal data in the European Economic Area (EEA). Further, the GDPR includes provisions elaborating the types of information which should be offered to research subjects when personal data are collected directly from them. Given the general norm that informed consent should be obtained before psychological research involving the collection of personal data directly from research participants should go ahead, the information which should be provided to subjects according to the GDPR will usually be communicated in the context of an informed consent process. Unfortunately, there is reason to believe that the GDPR’s obligations concerning information provision to research subjects may not always be fulfilled. This paper outlines the results of an empirical investigation into the degree to which these information obligations are fulfilled in the context of psychological research to which European data protection law applies. Significant discrepancies between the legal obligations to provide information to research subjects, and the information actually provided, are identified.