The Consent Check Before the First Aliquot: A 2026 Biobank Protocol Audit

You have the sample. You have the ethics number. You have a thawing rack and a queue of experiments. It is tempting to treat the consent form as background paperwork. In a biobank study, though, consent is closer to a protocol: it defines what you may do, what you may not do, and where you must stop.

Why consent is a protocol, not a preamble

A lab protocol has a version, a scope and stop points. A biobank consent form has the same job. It sets out the permitted uses of human tissue and data, the conditions for sharing, and the donor's choices about recontact or withdrawal. In the UK, that sits alongside the Human Tissue Act 2004, HTA licensing, NHS Research Ethics Committee approvals and UK GDPR. The consent form is not the only control, but it is the one you will reach for when a sample is already on ice.

Treat it as an operational document. If your planned experiment falls outside its scope, the correct response is not to squint at the wording until it seems fine. It is to pause and ask.

Match the form to the sample

Before you audit permissions, check identity. Which biobank supplied the material? Which consent version was signed? What REC reference and HTA licence apply? Is the sample part of a disease-specific collection or a broad population cohort? A consent form from a different collection, or an older version of the same form, can change what is allowed.

Pull the donor information sheet too. The consent form is a summary; the information sheet often explains commercial access, genetic analysis, data linkage and feedback of findings in more detail. If the biobank has a material transfer agreement or data access agreement, keep it with the consent record. Your lab notebook should be able to answer a simple question: why are we allowed to use this sample for this experiment?

Map permissions to your experiment

Make a short table. On the left, list what you plan to do. On the right, quote or paraphrase the consent clause that covers it. Include the awkward uses early: commercial research, industry collaboration, genomic sequencing, linkage to NHS records, transfer to a collaborator outside the UK, and any use in AI model training. Broad consent is common, but broad is not infinite. The form may permit future research while excluding commercial partners, or allow genomic data while limiting overseas sharing.

If the consent says samples will be anonymised before sharing, check what the biobank means by anonymised. Pseudonymised samples with a key are not anonymous. If the consent promises no individual results, do not build a return-of-findings pathway without checking. If the form mentions only one disease area, a new project in a different area may need an ethics amendment or a new approval. That is a conversation for the biobank and your research ethics contact, not a guess.

Dynamic consent: check the preference, not just the signature

Some UK biobanks use dynamic consent portals. Donors can update preferences, agree to new studies or withdraw from particular uses. In that case, the original signature is only part of the story. Check the current preference record and the date it was last updated. Record the version you checked in your lab notebook or sample management system.

If there is no dynamic consent, ask whether recontact is permitted and whether the biobank has a withdrawal log. A donor who withdrew last month should not appear in your thaw list this week. This is where a consent audit becomes practical: it connects a freezer box to a living preference.

Withdrawal and anonymisation are not the same thing

Withdrawal can mean different things. A donor may withdraw from further research, ask for samples to be destroyed, or ask for data to be deleted. Some anonymised data cannot be traced back for deletion. The biobank's standard operating procedure should say what happens, but your project still needs a stop point. If a withdrawal notice arrives, who checks the sample list? Who tells the bench? Who records the action?

Do not assume that a coded sample is safely anonymous. UK GDPR treats pseudonymised data as personal data when it can be linked back. If your project involves data linkage or re-identification risk, the consent and the data protection paperwork must match. When in doubt, ask the biobank's access team and your data protection officer. A five-minute email is cheaper than an unwinding study.

The 30-minute consent audit

Set a timer and work through these checks:

• Consent version, date, REC reference and HTA licence confirmed.
• Donor information sheet read, not just the form.
• Permitted use categories mapped to your experiment.
• Commercial and industry-sharing clauses checked.
• Genomic, linkage and overseas-transfer permissions checked.
• Current dynamic consent preferences or withdrawal status confirmed.
• Material transfer or data access agreement filed with the project.
• Sample coding and anonymisation claims understood.
• Named contact at the biobank for consent queries.
• Audit record saved with the experiment protocol.

If any line is blank, do not thaw. That is not bureaucracy for its own sake. It is the same discipline you would apply to an enzyme aliquot with no date on the tube.

Questions to ask before the first aliquot

Ask the biobank: Does this consent version cover our planned use? Has the donor changed preferences? What does withdrawal mean for this sample? Can we share data with this collaborator? What is the process for a new use? Ask your supervisor: Who signs off a consent query? Where is the audit record kept? Ask yourself: Could I explain this permission to an ethics committee in two sentences? If not, keep asking.

A stop point is a result

A consent audit is not a hunt for reasons to say no. It is a reproducibility tool. When the permission, the sample and the protocol line up, you can spend less time worrying and more time generating data that will survive scrutiny. In 2026, with more samples moving through shared biobanks and more data being reused, the consent check is part of the method. Treat it like one.