Data protection in research: Advice on conducting surveys

Components

Personal data – do you need to collect it?

Personal data is any information that can be used to directly identify a living individual, or indirectly used to identify an individual when used alongside other information that may be available.

Importantly, if your data set is pseudonymised, this is still personal data even where the ‘key’ to re-identify individuals is securely held separately from the data.

Keep in mind that the following survey returns would likely be considered to include personal data:

  • Surveys that include an in-depth set of questions that build a unique picture of the respondent, for example, because they ask about specific medical conditions, scenarios or experiences, alongside general location, age, and gender.
  • Surveys that include free text boxes, where it is likely or possible that the respondent will include information that will make them identifiable.
  • Surveys that collect IP address as a part of the survey, for example, to ensure that participants are only able to submit one return. IP addresses are categorised as personal data under data protection legislation.
  • Surveys that include a ‘keeping in contact’ option, where as part of the same return, individuals can include their email address.

If you are using surveys to collect data for your project, you should first consider whether you need to collect personal data to meet your intended aims. If you can use anonymised information whilst still meeting you purpose, this should be how you progress; anonymised information is not protected by the data protection legislation, meaning your data collection will be much simpler.

Remember that if you are using an external survey provider to capture personal data other than those mentioned on the authorised list, there are additional data protection requirements, and you are required to contact [email protected]. 

Ways to make survey returns truly anonymous

Consider ways to reduce the risk of identification:

  • For in-depth surveys, can you ask for age range instead of age or DOB? Do you really need to know what village or town they live in, or would area or city be enough detail? Can you include other pre-select options that group answers to reduce the likelihood of identification?
  • If you want to provide individuals with the option to be kept up to date with the findings of the project or be added to a contact list for future projects, can you link to a separate form so that the respondents survey isn’t linked to their contact details? Relevant wording has been provided below for you to include in your survey (hyper to ‘Where you separate out the ‘keeping in contact’ option’).
  • Can you turn off IP address collection? Under the UK GDPR, IP address is personal data. Collecting this information even on its own would mean you have to include the data protection wording in your PIS.
  • Can you include a disclaimer with free text boxes asking people not to include any information that would make them identifiable? Relevant wording has been provided below for you to include in your survey (hyper to ‘Where your survey includes free text boxes’).
  • Researchers sometimes ask the respondent to generate a unique identifier that only they are aware of for otherwise anonymous survey returns– this allows for them to request data deletion after they submit the response. Please note that this is not a data protection requirement and can actually mean the return includes personal data. The data protection team do not recommend that you provide this option.

Set wording to use in your surveys

1. Where you separate out the ‘keeping in contact’ option

Text to be included on main survey:

We would like to retain your name and [email address / telephone number] to [invite you to participate in similar future research projects / keep in touch about the findings of this project / send you information we think may be of interest to you]. If you would like us to do this, please complete this form [hyperlink to separate form]. Collecting your contact details in this way means that your responses to the survey will remain anonymous.

Text to be included on the contact form:

Manchester Metropolitan University (‘the University’) is the Controller in respect of the contact information you submit on this form. We use the personal data you provide to [explain the primary purpose, including how contact will be made – email/ sms etc]. We rely upon the legitimate interests lawful basis to process your personal data for this purpose. We will retain your contact information for a period of [X] years.

If you no longer wish to receive communications from us or would like us to delete your information you can contact us at [[email protected]]. For information about your data subjects rights and how to contact our data protection officer, please see our subject rights pages. You also have the right to complain to the Information Commissioner.

Please note you are still required to satisfy all ethical requirements, including providing a Participant Information Sheet to participants.

2. Where your survey includes free text boxes

This survey has been designed to ensure that responses provided are anonymous and cannot be used to identify you. However, there are free text boxes within the survey which we ask you to complete – please ensure you do not include any information which may be used to identify you.

Please note you are still required to satisfy all ethical requirements, including providing a Participant Information Sheet to participants.

3. Where individuals may decide to contact you for further information before deciding whether to participate

The following text can be included in the Participant Information Sheet for the project:

If you would like to find out more about this project, please contact the researcher using the contact details below. We will retain your contact information for the length of time necessary to answer your query, after which point, we will ensure it is deleted.