Research Privacy and Data Protection

This policy applies to participant, respondent, researcher, contact, field, audio, image, note, administrative, and digital data used in research. It is read with study-specific privacy notices, commissioner contracts, and applicable requirements.

• Nonidentifying or aggregate data.
• Pseudonymized data linkable through a separate key.
• Direct identifiers such as name, telephone, or identification number.
• Sensitive data such as health, politics, violence, or children’s information.
• Operational and technical data such as time, location, and device.
• Confidential materials owned by a commissioner or partner.

• Do not collect names or telephone numbers merely for convenience.
• Use participant codes rather than identifiers in instruments.
• Store linkage keys separately and securely.
• Delete contact information when no longer needed.
• Avoid open-text fields that elicit unnecessary identifying detail.
• Remove file metadata before publication or sharing.

Study notices explain who collects information, purpose, data categories, use, sharing, retention, rights, and inquiry channels. Separate permission is obtained for recording, recontact, or image use where required.

• Least privilege necessary for the role.
• Individual accounts and appropriate authentication.
• Periodic review and removal after assignment end.
• Access logging for highly sensitive data where practical.
• No permanent storage on personal devices or unapproved services.

• Encrypted connections and suitable services.
• No open email attachments for sensitive files.
• Protected devices and backups.
• Separation of contact details from responses.
• Known storage locations and providers.
• Assessment of international transfers according to sensitivity and safeguards.

Each project defines retention for raw, pseudonymized, anonymized, contact, recording, and consent information. Periods may vary by purpose, contract, audit, complaint, and law. When no longer needed, data are deleted, anonymized, or moved to restricted archives.

• Commissioners do not automatically receive identifying data.
• Outputs, ownership, and access rights are defined by agreement.
• Restricted data require data-use arrangements.
• Variables are removed or aggregated where reidentification risk is high.
• Participant contact and reidentification are prohibited.
• Data requests are reviewed for purpose, risk, and capacity.

Findings are published in aggregate or anonymized form. Small cells, qualitative quotations, maps, images, and stories are reviewed so combined detail does not identify a person, household, or sensitive location.

• Ask how information is used.
• Correct inaccurate identifying information.
• Request no further contact.
• Withdraw optional consent where applicable.
• Request deletion or restriction in appropriate cases.
• Complain about privacy or security.

Suspected loss, exposure, or unauthorized access is contained; necessary evidence is preserved; data, people, and potential harm are assessed; action and notification needs are determined; and causes are reviewed to prevent recurrence.

Restricted or identifying data are not uploaded to public AI or analysis tools. Provider contracts, processing location, retention, and training use are reviewed, and human responsibility for decisions and verification is retained.