IDG Guidance for Consent Process

Introduction

You will have received many consent emails since GDPR came into effect. We also prompt for consent on RDNCC systems accessed through the NIHR Hub's Single Sign On. 

The RDNCC Hub (also known as Identity Gateway or IDG) is a behind the scenes addition to the NIHR Hub which enables RDNCC systems to use the same single sign on mechanism. The consent process you will be going through now is a 2 step process covering both the individual system you wish to access and the RDNCC Hub itself. If you have an NIHR account, you have already provided consent for the NIHR Hub itself, when the Acceptable Use Policy was revised in May 2018 and then in April 2020. From a consent perspective RDNCC systems are separate to NIHR Hub systems.

How does this consent process work?

This consent process is not as intuitive as other prompts you will have seen, due to the way in which the single sign on process works. As such, here is some additional guidance.

This consent addresses three questions:

• Which system is being accessed?

• Does that system only require standard login (IDG)  information or is extra required? 

• Has consent already been provided? 

Consent is then applied as follows:

• To proceed you have to tick certain fields and you 'tick' to confirm your consent to certain data being used The 'data list' will be different for each system (ODP, CPMS, etc). Note that this list of data fields is not exhaustive and the system in question may well collect additional information. The linked Privacy Notice tells you more about how your data is used within the system. If there are optional fields and you do not select them then that data will not be transferred from the login provider (IDG) to the actual system you are trying to use. 

• To proceed you tick a box to confirm that you will adhere to the system Terms and Conditions and are content with the Privacy Policy. This is the key purpose of the new consent process, in line with the data protection provisions of GDPR.

• If you choose the “Cancel” option then the login process is simply cancelled - no data is deleted - you can come back, get the same prompt later, and then “Accept”. Anyone wishing for data to be deleted should contact the Service Desk.

• For a minority of users/systems (principally ODP new users) , there will be an additional consent screen the first time you “Accept” one of the systems. This presents more fields and a slightly different set of documents to consent to. This relates to IDG and is because of how consent is addressed within it. While there are some minor differences, these documents cover the same ground as those in the first consent screen. 

• So, if you use ODP, NIHR Learn and CPMS you will either end up going through 3 or  4 consent screens. One for each of the 3 systems you are interested in and one (if IDG requires it) for IDG. Once you have Accepted each individual system’s consent you will not be prompted again. 

Consent Flow Diagram

Other useful information

The IDG  Terms and Conditions  and Privacy Policy within this consent includes links to the comparable documents for the individual systems accessed through it.

For help and advice about this process contact the RDN Service Desk:

Email: rdn.servicedesk@nihr.ac.uk 

Phone: 0207 333 58 94 (Mon-Fri 8am-8pm)