Research Ethics and GDPR-Compliant Research

Respect for persons (autonomy): participants have the right to make informed decisions about their participation without coercion. This means: genuine informed consent before any data collection, the right to withdraw at any time without penalty, and honest representation of the research purpose. Beneficence: research should produce benefit and minimise harm. For commercial user research, this means: only collecting data you will actually use, using findings to genuinely improve the product rather than just validate existing decisions, and not designing studies that will cause distress. Justice: the benefits and burdens of research should be distributed fairly. This means: recruiting across user segments, not just the most accessible or cooperative participants; compensating participants fairly; and not exploiting vulnerable populations for convenience. Data minimisation: collect only the data necessary for the research question. Every data point collected creates a privacy obligation — collect nothing you cannot justify.

GDPR Article 7 requires consent to be freely given, specific, informed, and unambiguous. For research, this means your consent form must include: what data you are collecting (screen recording, audio, behavioural data), how it will be used (improving the product, internal analysis only), who will have access (named roles, not 'the team'), how long it will be retained (define a specific period, e.g., 12 months), the participant's right to withdraw and have their data deleted, and contact information for a data protection query. Consent cannot be bundled with terms of service — it must be a separate, standalone action. For screen recordings, consent must specifically mention video capture. Pre-ticked boxes are not valid consent. A compliant consent form also identifies the lawful basis for processing: for research, this is typically 'legitimate interests' or 'consent' — document your choice and be consistent.

1<!-- Minimal GDPR-compliant research consent form -->
2<form id="consent-form">
3  <h2>Research participation consent</h2>
4  <p>This session will be recorded (screen and audio) to help us improve
5     [Product Name]. Your recording will be stored securely and accessed
6     only by our product research team. It will be deleted after 12 months.</p>
7  <p>Participation is voluntary. You may withdraw at any time by closing
8     the session. To request deletion of your data after the session,
9     email [email protected] with subject 'Research data deletion'.</p>
10
11  <label>
12    <input type="checkbox" name="consent_recording" required>
13    I agree to this session being recorded (screen and audio).
14  </label>
15
16  <label>
17    <input type="checkbox" name="consent_data_use" required>
18    I agree my anonymised feedback may be used to improve the product.
19  </label>
20
21  <label>
22    <input type="checkbox" name="consent_age">
23    I confirm I am 18 years of age or older.
24  </label>
25
26  <p>You can withdraw consent and request data deletion at any time.
27     This will not affect any services you receive from us.</p>
28
29  <button type="submit">I agree — start the session</button>
30</form>

GDPR data minimisation principle: only collect data that is necessary for the stated research purpose. Do not record sessions 'just in case' — only record when you will review the recording. Storage limitation principle: define a retention period before the study begins and enforce it with automated deletion. 12 months is a reasonable default for most research recordings; anonymised insights can be retained indefinitely. Data subject rights: participants can request access to, rectification of, or deletion of their personal data at any time. Implement a research data deletion procedure: maintain a log of participant IDs and session files, and have a clear process for deleting all associated data on request. Anonymisation: when sharing findings internally, strip all identifiable information (name, company, role specifics that could identify the individual) before the data leaves the research team. Pseudonymisation (P1, P2 labels) is not the same as anonymisation — pseudonymised data is still personal data under GDPR.

Recording without consent: never start a screen or audio recording before consent is explicitly given. Fix: display the consent form as the first step of every session, before any recording begins. Deceptive study framing: telling participants they are testing something other than what they are actually testing. Fix: you can withhold specific hypotheses ('we are testing whether the blue button performs better') without lying about the study purpose ('we are studying how people complete this task'). Coercive incentives: making the incentive so large that participants feel they cannot decline. Fix: use market-rate incentives, not aspirational ones. Sharing identifiable recordings beyond the research team: sending session recordings to sales or marketing without participant knowledge. Fix: all sharing requires explicit secondary consent. Using research to identify dissatisfied customers for retention campaigns without consent. Fix: keep research data and CRM data completely separate. Recruiting participants from protected vulnerable groups (minors, people in crisis) without additional safeguards. Fix: establish exclusion criteria for vulnerable populations and additional consent procedures when inclusion is justified.

Before starting any research study, complete a lightweight ethical review. Consent: Is written informed consent obtained before any data collection? Does the consent form meet GDPR Article 7 requirements? Data collection: Is every data point collected necessary for the research question? Is there a defined retention period and deletion procedure? Participant rights: Can participants withdraw at any time without penalty? Is there a clear contact for data deletion requests? Recruitment: Are participants recruited from representative user segments, not just the most convenient? Are incentives market-rate and non-coercive? Harm assessment: Could any aspect of the study cause distress or embarrassment to participants? If yes, is it justified and mitigated? Data security: Is research data stored in an access-controlled location? Is raw recording data separated from participant identity data? Document this checklist completion in your study plan. For studies involving sensitive topics (health data, financial information, children), request a review from your organisation's legal or data protection officer before proceeding.