Data protection

As we explained in step 2.2, every piece of information you collect about individual users during user research counts as personal data. This may include their names, contact details, and email addresses.

In the UK, personal data is regulated by the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. These pieces of legislation set out how data is collected, stored, used, and deleted.

When you conduct user research, participants often share personal and sensitive information about their identities and experiences. If that data is mishandled, it could have serious consequences – not just for your participants, but also for you, and the organisation you represent.

It is important to remember data protection is about more than the law – it is also about ethics, respect, and trust. Protecting users’ privacy and data is a key part of conducting responsible and ethical research. It shows participants that you respect them, their privacy, and their dignity.

Ethical user research means treating people with care and ensuring that their information is handled responsibly at every stage of the process.

Let’s explore the main principles of data protection under UK GDPR. If you would like to know more, you can read about these in detail on the Information Commissioner’s office website.

Data protection while planning research

Understanding data protection is essential from the beginning of your career as a user researcher.

While you will become more confident over time, you are not expected to know everything or manage it all on your own. Most organisations have data protection processes and policies in place, and you should work with your team, manager, or Data Protection Officer (DPO) to make sure your plans are appropriate and approved.

Navigating policy or legislation can be confusing, but there are practical steps you can follow to ensure you are collecting and using data correctly. You should:

• write a privacy statement in plain English that explains what data will be collected, how it will be used, who will have access to it, and how it will be stored
• get informed consent in writing before collecting any data
• follow your organisation’s policy for data storage (for example, using specified devices or software)
• never use personal or unsecured devices to store user research data
• only collect relevant data and retain it for no longer than necessary
• work with your DPO, data protection team, or lead user researcher to create a data protection plan, and to understand your team’s reporting procedure for breaches
• anonymise or pseudonymise personal data where possible, based on participant needs and your user research
• record all decisions for accountability

You can also self-assess your approach to data collection as you plan your user research. Ask yourself:

• what personal data you will be collecting
• why you need the data and how you will use it
• if the user research method you have chosen is the best method for collecting the data, or if you should use an alternative
• how you will store the data securely, who else will have access to it, and for how long will it be stored
• if your user research requires identifying data or if an participants remain anonymous

As we explained in previous steps, we can never completely avoid risk in user research. However, careful planning, working with colleagues, and ensuring that you are up to date with your team and organisational policies can significantly reduce the chance of something going wrong.

Accidents happen, but with enough preparation, we can minimise the risks.

Lawfulness, fairness and transparency

You must assess and explain what data you are collecting, why you need it, and how it will be used.

Personal data must only be collected if there are justifiable reasons for personal data use – known as ‘lawful basis’ in UK GDPR. This is why user research must be carefully planned, and your proposal approved before you begin.

You must also ensure that you use data in a way that is fair. Fairness means handling personal data in ways that people would reasonably expect and not using it in ways that have unjustified adverse effects on them. You need to be objective and avoid misrepresenting data to suit your own biases. You must also avoid tricking or misleading people into giving you data that they do not want to.

Transparency here means honesty. You must be clear, open, and honest with your participants about how you will use their data. This should be from the start of your user research and continue throughout, with all explanations written in plain English.

Purpose limitation

You must only use personal data for the specified purpose you have clearly explained to participants. Under UK GDPR, this is known as ** purpose limitation**.

Data collected must only be used for explicitly specified purposes. Using data beyond its specified purpose without seeking further permission can constitute a breach of data protection regulations.

You must be clear about your reasons for collecting and processing data from the start. This information should be provided to participants before the user research begins, typically in a privacy statement.

If you want to reuse data, you need to obtain fresh consent and provide a new privacy statement explaining what you intend to do. For example, a video recording of an interview could be useful for training purposes for new user researchers, but the participant must be told this and give permission for their data to be used in this way.

If the participant does not give consent, you must not use their data for anything else other than the original purpose specified.

Data minimisation

You should identify the minimum amount of personal data you need to fulfil your user research purpose, and collect no more than that. UK GDPR states that personal data must be used “in a way that is adequate, relevant and limited to what is necessary.”

Adequate means collecting enough data to meet your user research goals. There is no point in conducting user research that does not give you enough information to actually make useful insights – you are just wasting time and resources.

Relevant means only collecting data that clearly relates to the purpose of your user research. Avoid gathering information that you do not need. This is again to ensure that you stay focused on the topic of your user research, as well as to minimise the risk of confidential information being shared unnecessarily.

Limited to what is necessary means that you do not gather and store more than you need to fulfil your purpose. Though you do need to collect an ‘adequate’ amount of data to fulfil your purpose, once you have enough, you should stop. User research should not go on for longer than it needs to, and you should not just keep collecting data without a clear reason to do so.

Accuracy

It is essential that all personal data you hold is accurate and up to date. You must take reasonable steps to ensure that the information is not factually incorrect or misleading. Depending on its intended use, personal data may require periodic updates to maintain its relevance and accuracy. For example, if you are keeping data for a long-term study, or using a participant panel, you may need to refresh the information to make sure it is still relevant.

If you find any personal data is incorrect or misleading, you must take prompt and appropriate action to correct or delete it. For example, ages of survey respondents are important demographic information, but will very quickly become out of date and affect your ability to draw conclusions from that data set.

You must take any concerns or questions about the accuracy of personal data seriously, and respond with care. This is especially important when comparing different groups, such as age groups or genders, where accuracy affects both the quality of your user research and how fair it is.

Storage limitation

Data must not be retained for longer than necessary.

As part of your data protection plan, you need to determine and be able to justify how long you will need to keep personal data. Your organisation may have standard policies for data retention that you can follow, but there may be instances where an exception is needed. This is acceptable so long as there is a valid reason for doing so, and you record your decision and justification for this in your data protection plan.

You should periodically review data to identify anything that is no longer needed. You also need to respond to participant requests for their data to be deleted – individuals have a right to know what data you hold about them and to decide what should happen to it.

Integrity and confidentiality

Data must be stored securely, using approved devices and systems, with access limited only to the people who need to see it. Appropriate technical and organisational measures must be in place to protect personal data.

Phrases like ‘data protection’ or ‘data breach’ might make you think of hackers and digital scams, but one of the most common causes of data breaches is human error. It can be tempting to use a personal device or email for convenience, but this increases the risk of data being lost, misused, or seen by the wrong person.

You should follow your organisational guidelines for data storage and protection, ensuring that data is kept on encrypted devices or in safe cloud locations with password protection.

Where appropriate, you should ensure that data is anonymised or pseudonymised before it is shared. This means removing or replacing identifying personal data to protect the identities of your participant.

The method of storing and sharing data you choose should reflect the needs of your user research and your data protection plan. Always double check who you are sending it to and why.

Sending personal data by email can be a common cause of data breaches, especially if sent to the wrong recipient. Always adjust document access permissions carefully and check multiple times before sharing. Be cautious with spreadsheets, as hidden cells can be visible when shared. You should seek advice from your organisations data protection, security, or governance teams for the most secure ways to share personal data with others, especially if you are intending to share personal data of multiple participants.

Accountability

You need to be able to show that your data protection plan complies with regulations. It is important to keep records of all discussions and decisions made regarding your data plan, which should be stored securely, and be available to all team members. This is also a key safeguard for addressing data breaches.

If you have a clear plan and a record of when data was collected, where it was stored, who has access to it, and how it was used, it will be much easier to identify and address lapses in security.

Task

Think about how data protection is managed in your organisation or team.

What policies or processes are in place? Do you know where to go for advice or to report a data breach? Are there any aspects of data protection, such as writing privacy statements, managing consent, or sharing data securely that you are unfamiliar with and need to learn more about?

Share your thoughts in the comments below. As a reminder, do not share anything sensitive or confidential, but just reflect more generally on data protection and the steps we can all take to ensure data is handled responsibly.