Research Ethics: Informed Consent, IRB, Ethics Approval and GDPR
Reviewed by Prof. Dr. Alexander Holtermann · Updated 16 October 2026 · 6 min read
Research with people needs informed consent, ethics approval (IRB in the US, ethics committee in the UK/EU) and data protection that meets the GDPR.
Key takeaways
- Core principles: respect for persons (voluntary, informed consent), minimizing harm, fairness, confidentiality and integrity in how you handle data.
- In the US, an Institutional Review Board (IRB) reviews research with human subjects under the Common Rule; studies are exempt, expedited or full-board review.
- In the UK and EU, a university research ethics committee approves projects; NHS research in the UK goes through the Health Research Authority and NHS ethics committees.
- The UK GDPR and EU GDPR apply to personal data. Pseudonymized data remain personal data; only truly anonymized data fall outside the law.
- Apply early: approval often takes two to eight weeks, and you must not collect data before it is granted.
Why research ethics matters
Research ethics protects participants, researchers and the credibility of science. Historical abuses led to today’s frameworks: the Nuremberg Code (1947), the Declaration of Helsinki for medical research, and in the US the Belmont Report (1979), which set out three principles: respect for persons, beneficence and justice. National frameworks, such as the UK Economic and Social Research Council’s framework and discipline-specific codes from professional associations, build on these principles.
For you as a student, ethics is also practical: without approval, you may not be allowed to use your data, and your dissertation may fail.
Core principles in practice
Most ethics forms ask how you address these principles:
| Principle | What it means | How you show it |
|---|---|---|
| Informed consent | Participants understand the study and agree freely | Information sheet, consent form, right to withdraw |
| Voluntariness | No pressure or dependency | Avoid recruiting your own students or direct reports; no penalties for declining |
| Minimizing harm | Physical, psychological, social, legal risks are minimized | Risk assessment, support contacts, distress protocol |
| Confidentiality | Information is protected | Pseudonymization, secure storage, careful reporting |
| Fairness | Benefits and burdens are fairly shared | Inclusive recruitment, reasonable incentives |
| Integrity | Honest conduct and reporting | No fabrication, transparent methods, data management plan |
Informed consent: what it must include
Consent must be informed, voluntary and documented. A good information sheet uses plain language and covers:
- who you are, your institution and supervisor
- the purpose of the study and why the person is invited
- what participation involves (time, format, recording)
- possible risks and benefits
- that participation is voluntary and they can withdraw without giving reasons, and until when data can be withdrawn
- how data are stored, who has access, how long they are kept, and how results will be published
- how confidentiality is protected and its limits (e.g. focus groups, safeguarding disclosures)
- contact details, including an independent contact for complaints
United States: the IRB
In the US, research with human subjects at institutions receiving federal funding is governed by the Common Rule (45 CFR 46). An Institutional Review Board (IRB) reviews protocols. Depending on risk, studies fall into three categories:
- Many IRBs require completion of research ethics training (often an online course) before submission.
- Only the IRB decides whether a study is exempt; you cannot decide this yourself.
- Class projects that are not designed to produce generalizable knowledge are sometimes not considered “research” under the Common Rule. Your IRB makes that determination.
| Category | Typical examples | Process |
|---|---|---|
| Exempt | Anonymous surveys of adults on non-sensitive topics, educational tests | Brief review, often by IRB staff; still needs a determination |
| Expedited | Minimal risk research, e.g. recorded interviews | Review by one IRB member |
| Full board | More than minimal risk, vulnerable populations | Review at a convened IRB meeting |
United Kingdom and EU: ethics committees and the GDPR
In the UK, universities have research ethics committees (often at school or faculty level). Low-risk student projects may be approved through a simplified or supervisor-level review; higher-risk ones go to the full committee. Research involving NHS patients, staff or premises requires approval through the Health Research Authority (HRA) and often an NHS research ethics committee. Professional bodies provide discipline-specific guidance, for example in education and psychology.
In the EU, procedures vary by country and institution, but the GDPR applies everywhere.
- Personal data: any information relating to an identifiable person, including voice recordings, email addresses and IP addresses.
- Special category data (health, ethnicity, religion, sexual orientation, political opinions etc.) need extra safeguards.
- Lawful basis: for university research this is often “public task” rather than consent. Ethical consent to participate is still required separately.
- Transparency: a privacy notice tells participants what you do with their data.
- Data minimization and storage limitation: collect only what you need and delete it when no longer required.
- Data security: use university-approved storage and services; avoid personal cloud accounts and messaging apps for research data.
Anonymization and pseudonymization
Pseudonymization replaces direct identifiers (names, emails) with codes; a key allows re-identification. Pseudonymized data are still personal data under the GDPR. Anonymization means that individuals can no longer be identified by any means reasonably likely to be used, including combinations of variables. Only anonymized data fall outside data protection law.
In practice, qualitative data are rarely fully anonymous. Small groups and rich details (job title, location, rare experiences) can identify people. Generalize details, aggregate small categories in surveys (e.g. report “other” if fewer than five people), and check quotes carefully before publication.
Special situations
Some situations require extra care and often full committee review:
- Children and young people under 18 (parental consent plus the young person’s assent)
- Adults who may lack capacity to consent
- Participants in dependent relationships with you (your own students, employees, patients)
- Sensitive topics: mental health, sexuality, illegal behavior, trauma
- Covert research or deception
- Research abroad or online communities, where local laws and platform terms apply
Planning your ethics application
Start early, ideally while you write your proposal. Typical documents: application form, research protocol, information sheet, consent form, questionnaire or interview guide, recruitment materials, data management plan and risk assessment. Expect revisions. Ethics procedures differ considerably between institutions and countries; your university’s own guidelines and forms take precedence. Upload them to Professor Digital and the checklist for your application is tailored to them. Our survey tool at /umfragen includes a consent page you can adapt to your approved wording.
Frequently asked questions
Do I need ethics approval for my dissertation?
Almost always, if you collect data from or about people (surveys, interviews, observation). Some literature-only or secondary data projects need only a short self-assessment. Check your department’s procedure.
What is an IRB?
An Institutional Review Board is a US committee that reviews research with human subjects to protect participants. It decides whether studies are exempt, expedited or need full board review.
What should an informed consent form include?
The purpose, what participation involves, risks and benefits, voluntariness and the right to withdraw, data handling and confidentiality, and contact details including an independent contact.
Is pseudonymized data anonymous under the GDPR?
No. Pseudonymized data can be re-identified with a key and remain personal data. Only data that can no longer identify anyone by reasonably likely means count as anonymous.
How long does ethics approval take?
Often two to eight weeks, depending on risk level and committee schedules. NHS or full-board reviews can take longer, so apply as early as possible.
Sources and further reading
- Clark, T., Foster, L., Sloan, L., & Bryman, A. (2021). Bryman’s Social Research Methods (6th ed.). Oxford University Press.
- Creswell, J. W., & Creswell, J. D. (2023). Research Design: Qualitative, Quantitative, and Mixed Methods Approaches (6th ed.). Sage.
- Brinkmann, S., & Kvale, S. (2015). InterViews: Learning the Craft of Qualitative Research Interviewing (3rd ed.). Sage.
Your university’s examination regulations and style guide always take precedence.
Related articles
- Interview transcriptionTranscription turns interview recordings into text. Choose verbatim or intelligent verbatim, set clear rules and pseudonymize names before analysis.
- Questionnaire designA good questionnaire starts from your research question, uses validated scales, neutral wording and a logical order, and is pilot tested before launch.
- Semi-structured interviewsA semi-structured interview follows an interview guide of open questions but lets you change order, follow up and probe. Typical: 8–15 interviews of 45–60 min.
- Observation researchObservation means systematically watching and recording behavior in its setting. Key choices: participant or not, structured or not, overt or covert.
- Research proposalA research proposal explains what you will study, why it matters, and how you will do it: title, background, questions, method, timeline, references.
- Focus groupsA focus group is a moderated discussion with 5–8 participants on a defined topic. It reveals shared views and how opinions form through interaction.
