Research ethics and data protection: consent, confidentiality, minors and vulnerable groups

1. The problem: respondents' trust is a shared resource

A social programme wants to know how many women in rural communities have experienced domestic violence. A telecoms company wants to record its customers during interviews. A school agrees to a survey on alcohol use among its pupils. All three are legitimate research questions, and all three can cause harm if handled carelessly: a respondent identified by her abuser, a customer who did not know he was being recorded, a pupil whose answers reach the form teacher. Research ethics is the set of rules that makes it possible to obtain this information without harming the people who provide it.

The stakes are not only moral. Research depends on people's voluntary cooperation, and every abuse, whether a "survey" that ends in a sales pitch or a data leak, makes everyone a little less willing to take part. Lower response rates mean less representative samples and more expensive studies for all. That is why the industry has long regulated itself through professional codes, including the ICC/ESOMAR International Code, and why data protection law has added clear legal obligations on top.

2. Research ethics: the core principles

Professional codes are worded differently but converge on a handful of principles that apply to any study, from a customer satisfaction survey to social research on sensitive topics.

• Voluntary participation. No one is obliged to answer, to continue the interview or to answer any particular question. Refusing carries no consequences.
• Informed consent. Before agreeing, respondents know who is conducting the study, its general purpose, how long it takes, what happens to their data and what rights they have.
• Avoiding harm. Taking part must not expose respondents to physical, psychological, social or financial risk.
• Confidentiality. A respondent's identity is not disclosed to the client or third parties without their explicit agreement, and results are reported in aggregate.
• Honesty towards respondents and clients. Research is not used as a pretext for selling or fundraising, and findings are not bent to confirm what someone wants to hear.

These principles depend on each other. Consent means little if a respondent cannot refuse without consequences, and promised confidentiality means little if the data are not technically protected. In practice, research ethics means that every promise made to the respondent in the introduction is kept at every stage: fieldwork, processing, reporting and archiving.

The last principle has a side that concerns the client directly. A questionnaire deliberately built to produce a particular result, for example with leading questions, breaches research ethics just as surely as a breach of confidentiality. More on neutral wording in our article on questionnaire design.

3. Informed consent in practice

Informed consent is not a formula rattled off at the start of an interview. It is a genuine understanding, adapted to the method and the population. At a minimum, respondents are told: the name of the organisation conducting the study, the general purpose of the research, the approximate length, that taking part is voluntary and that they can withdraw at any time, how their data will be used and protected, whether the interview is recorded and who may listen to it, and a contact for questions.

The form depends on the method. In face-to-face and telephone interviews, consent is usually verbal and logged in the interviewing software. Online, it is an acceptance screen that cannot be skipped. In focus groups and in-depth interviews, where discussions are recorded on audio or video and the client may observe, consent is usually written and explicitly mentions the recording and the presence of observers. For how these sessions run, see how focus groups work.

4. Personal data: what, how much and for how long

Any study that keeps names, phone numbers, addresses, voice or video recordings, or combinations of characteristics that allow someone to be identified, is processing personal data. In Moldova, the main framework is Law no. 133/2011 on personal data protection, and for studies that involve people in the European Union or clients based in the EU, the General Data Protection Regulation (GDPR) applies as well. The legal detail is checked project by project; the practical principles are the same everywhere.

• Minimisation. Collect only the data the purpose requires. If the analysis needs age bands, do not ask for a date of birth.
• Separation. Contact details are stored apart from the answers, linked only by a code. The analysis team works on a dataset without names.
• Security. Tablets are encrypted, transfers go through secure channels, access is limited to those who need it.
• Limited retention. Identifying data are deleted once quality control and contractual obligations are complete, on a deadline set in advance.
• Disclosure. The client receives aggregate results and anonymised datasets. Beware of apparent anonymity: in a small village or a company with few staff, a combination of age, occupation and location can identify a person even without a name.

When a client provides its own customer list for sampling, there must be a legal basis for passing it to the agency and a written agreement on how it will be used, protected and deleted. This is settled before fieldwork, not after.

5. Minors and vulnerable groups

Children and adolescents

Studies with minors require the consent of a parent or legal guardian and, separately, the agreement of the child, sought in language the child understands. A child who does not want to take part does not take part, even if the parent has agreed. Questions are adapted to age, sensitive topics are handled with particular care, and in schools it is made clear that teachers have no access to individual answers. Professional codes contain specific provisions for research with children, and age thresholds are checked for each country and type of study.

Vulnerable groups

Vulnerability is not only a matter of age. Older people with cognitive difficulties, people with disabilities, survivors of violence, displaced people, people living in institutions or dependent on the programme funding the study all have a reduced ability to refuse or to protect themselves. For them, research ethics demands extra measures:

• Interviews in private places, out of earshot of family members or institutional staff.
• Specially trained interviewers, usually of the same gender as the respondent in studies on gender-based violence.
• Procedures for crisis situations: what the interviewer does if a respondent is in danger or deeply distressed, with information on support services they can be referred to.
• An explicit assurance that taking part or refusing does not affect access to services or to a programme's assistance.
• Proportionate incentives that do not become pressure to take part.

In social programmes, these safeguards are part of the design, not an annex. They shape the collection method, the interviewer profile, the timeline and the budget, as our article on the KAP study also shows.

6. Situations that need particular care

Some methods raise specific ethical questions. In mystery shopping, the staff being observed do not know about the visit at the time: accepted practice is to assess processes and service standards, and not to use results for individual sanctions unless staff have been informed about the programme. Clients observe group discussions only with participants' knowledge. Audio recordings in telephone surveys, used for quality control, are announced at the start of the call. And in social and political research, where findings can shape public debate, honest reporting, including publishing the methodology and margins of error, is part of the ethics of the study; more on our social and political surveys page.

7. Risks and safeguards by type of study

8. Common mistakes

Most breaches come not from bad intent but from haste and deadline pressure. Research ethics is usually breached in small details repeated hundreds of times in the field, not through one dramatic decision. These are the situations we see most often:

• Consent treated as a formality, read so fast that the respondent does not understand what they agreed to.
• A client asking for "the dataset with names, so we can call the unhappy ones", when respondents never agreed to that.
• Collecting personal data "just in case", when it serves no analysis.
• Reports with quotes or subgroup tables so small that people can be recognised.
• No deletion deadline for identifying data and recordings.
• Studies on sensitive topics without training interviewers for difficult situations.

9. What to ask the agency about ethics and data protection

• Which professional code do you follow, and how is it applied in this project?
• How do you obtain and document informed consent for each method?
• Which personal data do you collect, why, and when do you delete them?
• How are identifying data kept apart from the answers, and who has access to them?
• What do we, the client, receive: aggregate data, anonymised datasets, recordings?
• What protocol do you use for minors and for vulnerable groups?
• How are interviewers trained for sensitive topics and crisis situations?
• How will the customer list we provide for sampling be handled?

Research ethics does not slow a study down; it guarantees its value. Respondents who trust the process answer more honestly, and findings obtained properly can be used and defended in public. Informed consent and the protection of personal data are planned from day one, just like the sample and the questionnaire, and a proposal that does not mention them is incomplete; see also how to evaluate research proposals. If you are preparing a study with sensitive populations or with your customers' personal data, our focus groups and IDI team and our survey team can help you build it properly, and quick answers are on our FAQ page.

See also: Social and political surveys Focus groups and IDI Frequently asked questions The KAP study How to evaluate research proposals How focus groups work

The Perspicuus research team · 19 November 2025