User research is a crucial part of product design, but it also involves collecting and handling sensitive data from your participants. How can you ensure that you respect their privacy and protect their information from unauthorized access or misuse? Here are some tips to help you keep user research data confidential.
Before you start your research, you should have a clear idea of what data you need, why you need it, and how you will use it. This will help you avoid collecting unnecessary or excessive data that could pose a risk to your participants or your organization. You should also inform your participants about the purpose and scope of your research, and obtain their consent before you collect any data from them.
Especially for data collection related to User. The scope of the study to be well defined so you could decide what input data to be collected. Once you have rough list You should ask 2 questions. What will be the data collected and how will you use it in your study. It will help to reduce any redundant and unnecessary data collection.
Once you have collected your data, you should store it securely and encrypt it to prevent unauthorized access or theft. You should also anonymize your data by removing or masking any personally identifiable information (PII) such as names, email addresses, phone numbers, or locations. This will help you protect your participants' identity and privacy, and reduce the potential harm if your data is compromised.
We always tried to make the data related to the research project protected by a password (eg. brainstorming in Miro) and limited accessibility to the important data dashboard with limited accounts (eg. Tableau). Another important thing that is often dismissed is to never post the research process casually on any social media (unless it is intended). Be mindful of whatever is shared since our social media is also the representation of the company.
Especially data related to personal information or indirectly related (possibility to track identity), such data should be anonymise. Also care to be taken during data storage and processing. Normally encryption or password protection will help to protect during data transfer.
Using proper tools is essential. Research never had a great set of tools. As a result, the data gets split into multiple places, which makes it harder to protect. With the maturity of AI and LLM, we are seeing a lot of good tools popping up. This will help with protecting data.
Depending on where you conduct your research and where your participants are located, you may have to comply with different data protection laws and regulations. For example, if you are dealing with data from the European Union, you should follow the General Data Protection Regulation (GDPR) which sets strict rules and standards for data collection, processing, and storage. You should familiarize yourself with the relevant laws and adhere to them to avoid legal issues or penalties.
You should only share your data with the people who need it for the research project, and limit their access to the minimum necessary. You should also monitor and track who accesses your data, when, and for what purpose. You should use secure platforms and tools to share your data, and avoid using public or unencrypted networks or devices. You should also establish clear policies and guidelines for data handling and disposal, and train your team members accordingly.
When your research project is completed, you should delete or archive your data according to your data retention policy and the participants' preferences. You should not keep your data longer than necessary, or use it for purposes other than those agreed upon with your participants. You should also ensure that your data is deleted or archived securely and permanently, and that you have a backup plan in case of data loss or corruption.
Finally, you should review and improve your data practices regularly, and seek feedback from your participants and stakeholders. You should evaluate the effectiveness and efficiency of your data collection, storage, and sharing methods, and identify any gaps or risks. You should also update your data policies and procedures to reflect the changes in your research goals, methods, or context, and the best practices in your industry or domain.