Research Services guidance on selecting a lawful basis for research. It isn't possible to link directly to the relevant information, please go to: Lawful - selecting a lawful basis for the processing of personal data
A useful link to the Department of Health guidance on consent under the common law. It is important not to confuse this with consent as a basis for processing under the GDPR. This link is included as a good starting point if things are getting confusing - please check the Research Services advice on this.