Ethical Considerations for Data Collection: A Practical Guide for Researchers and Professionals

Research, healthcare, education, business, technology, public administration, etc., rely on data collection. Data serves a multitude of purposes for researchers and practitioners, including assessing services, conducting research studies, understanding behavior, quantifying results and making evidence-based decisions about populations. But with the collecting of information comes ethical obligations. No amount of conforming to technical procedures guarantees a project’s privacy protection, nor does it ensure that it is designed to prevent discrimination, embarrassment, financial damage, or harm to the subjects’ reputation. The ethical implications in data collection should be integrated throughout the data life cycle from designing the study to recruitment, consenting, collection, storage, analysis, reporting, sharing, data retention and data deletion. This hands-on manual provides a clear account of what steps must be taken, practical examples of ethical approaches, checklists, and templates to guide researchers and practitioners in collecting data ethically.

Figure 1. Ethical data collection across the responsible data lifecycle.

1. Define the Purpose Before Collecting Data

Designing a survey, interview, registration form, clinical study or digital platform requires a clear understanding of the reasons for each piece of information required. Each question and/or variable should address a specific research objective, an operational requirement, or a research purpose. For instance, information about age group, treatment type, waiting time and the patient experience might be useful to a healthcare researcher interested in treatment satisfaction. However, unless these factors are directly relevant to the study, it is not necessary to obtain the information regarding the religion of the participant, the full residential address, name of the person’s employer or the family’s income.

A useful test is:

“Would the project still achieve its objective without collecting this information?”

When the answer is yes, the information should normally not be collected.

This approach supports data minimisation, reduces security risks, simplifies data management, and improves participant confidence.

2. Use a Practical Informed Consent Process

Informed consent is more than obtaining a signature or asking participants to select an “I agree” box. Before giving out the information they enter, participants need to know exactly what they are agreeing to. The consent process should be clear and make it known that the following will be explained:

1. The purpose of the project
2. The information being collected
3. How the information will be used
4. Who can access the data
5. Whether data will be shared with third parties
6. How long the data will be retained
7. Possible risks or discomfort
8. Whether participation is voluntary
9. How participants can withdraw
10. Whom participants can contact with questions

The language in a consent form should be straightforward. Where technical, legal or medical terms are used they should be explained.

Practical Consent Template

• Purpose: We are collecting this information to evaluate [name of study, service, programme, or project].
• Information collected: We will collect [list the main categories of information].
• Use of information: Your information will be used for [specific purpose].
• Data access: Only [research team, authorised employees, investigators, or named departments] will have access.
• Voluntary participation: Your participation is voluntary. You may refuse to answer any optional question or withdraw before [state the applicable stage].
• Data retention: Your information will be retained for [period] and then securely deleted, anonymised, or archived.
• Contact: Questions about the project may be sent to [name, role, email address, or telephone number].

3. Protect Personal Information

Personal Information protection refers to any identifiable information that can be directly or indirectly attributed to a person, such as names, telephone numbers, email addresses, residential addresses, photographs, dates of birth, employee numbers, health details, financial information, device information and location. Researchers and practitioners need to classify information they gather by level of sensitivity and ensure that sensitive information (e.g., sexual behaviour, trauma, medical conditions, financial hardship, legal non-conformity, disability, income) is gathered only in so far as it is necessary for the purpose of any research or project.

Practical Example

A University researcher is researching workplace stress. These include all the details the original questionnaire asks of the participant including their full name, employee ID, department, designation, age, gender, salary, supervising name and mental health history. Such a pairing might readily be used to identify individual employees:

• Remove names and supervisor details
• Replace exact age with age groups
• Replace exact salary with income ranges
• Make mental health questions optional
• Avoid collecting employee IDs
• Report results only at an aggregated level

4. Handle Data Collection Contact Details Separately

Contact information for Data Collection might be required for scheduling interviews, reminders, information on who is participating and verifying participation, information on results, and follow up assessments. But, contact information should not be saved with answers to the survey, clinical responses, or data from clinical interviews:

File 1: Contact File

• Participant name
• Telephone number
• Email address
• Follow-up date

File 2: Research Dataset

• Participant code
• Study responses
• Measurements
• Outcomes

The two files should only be related to each other by the participant code. Contact information should not be used in advertising or sales communication or projects that are not directly related to the inquiring party’s work unless separate and explicit permission is given.

5. Use a Unique ID in Data Collection

Direct identification can be minimised with the use of a Unique ID in data collection instead of using names.

Examples include:

• P001
• STUDY-2026-015
• CLINIC-A-104
• RESP-0087

Data from the research should include Unique ID (not the participant’s name). There are some limitations with using a code; however, data is not necessarily anonymous if there is a separate file that identifies the participant by the code. The linking file should, therefore, be encrypted, password protected, kept separate from other files, not accessible to anyone but authorised people, and securely destroyed once it is no longer needed for identification.

Practical Example

A clinical researcher takes the blood pressure, age, medication and treatment response of patients.The researcher codes the patient – not the patient’s name, but instead the code PAT-042 is entered into the analysis file. The document showing the correlation between PAT-042 and the patient’s identity is contained in a limited hospital system. The data is coded before being forwarded to the statistical analyst with only the coded data sent.This serves to ensure confidentiality and provides an opportunity to have follow-up by the clinical team.

6. Protect Privacy During Collection

Face-to-face interviews, telephone interviews, online surveys, observations and group discussions can all pose privacy hazards. It is important not to conduct a sensitive interview where colleagues, family members, patients or other participants can hear the answers.

Suitable and secure platforms are to be used in online forms. Researchers need to examine whether the platform is gathering “unnecessary” metadata, such as location information, IP address or device information. It is important to note that participants should be made aware that for focus groups the research team will be unable to completely ensure confidentiality of the discussion during the focus group, when other group members are present.

7. Review Fairness and Inclusion

Relevant groups should not be unfairly excluded during the gathering of data (which should be done in an ethical manner). Researchers should ask before they begin to collect because:

• Is the survey available in an understandable language?
• Can people with disabilities access the form?
• Are people without internet access excluded?
• Do the answer categories reflect the population?
• Could any question appear judgemental or discriminatory?
• Are vulnerable participants able to refuse freely?

For instance, a health survey conducted online could leave out older people, lower income groups, people in rural areas or those who aren’t as computer literate. Assisted participation and/or telephone or paper options would be helpful for researchers.

8. Prepare a Data Security Plan

Ethical responsibility doesn’t end with collection. Digital data should be safeguarded using an appropriate method including:

• Encryption
• Multifactor authentication
• Role-based access
• Secure backups
• Audit logs
• Approved cloud storage
• Strong passwords
• Regular access reviews

Lock up paper files and documents in cabinets or secure spaces.Researchers should not communicate discs of sensitive data via personal email addresses, file sharing links, personal messaging services, or unencrypted disks.

9. Apply a Clear Retention and Deletion Schedule

Data should not be retained indefinitely simply because storage is available.

A retention schedule should state:

The retention period should reflect institutional requirements, professional standards, contractual obligations, research needs, and applicable regulations.

Practical Ethical Data Collection Checklist

Before launching a project, confirm that each requirement below has been reviewed and completed:

Conclusion

Ethical issues related to data collection should not be summarised in policies or research proposals, but rather viewed as a practical matter or criteria for projects. Researchers and/or practitioners should record only useful data, have meaningful consent, safeguard Personal Information, and also have Data Collection contact information separate from data, have a secure Unique ID while gathering information, avoid unfair exclusion of people, limit access and delete unnecessary data. Implemmenting these measures at a study’s outset not only enhances the quality of the data but also ensures the safety of participating students, promotes accountability for the teachers, minimizes organizational risk, and promotes the public’s trust in the long-term.

Book a free consultation for appointment

Email us at :grow@simbi.in