How can you protect participants’ data in a research project?

The protection of personal information is now an essential component of any research project involving participants.
Whether data is collected via an online questionnaire, a research platform, a mobile app, or another digital tool, researchers remain responsible for protecting it throughout the project.
Beyond technical considerations, this responsibility falls within an increasingly demanding ethical, regulatory, and legal framework. Research ethics committees now pay particular attention to the measures put in place to ensure the confidentiality, security, and governance of participants’ data.
Considering data protection from the very beginning of the study design not only reduces risks but also facilitates ethical approval and strengthens participants’ trust.

The first step is to identify the information that will be collected as part of the study. Not all data carries the same level of risk. For example:

• a participant’s name and contact information;
• health data;
• testimonials;
• questionnaire responses;
• location data;
• financial information;
• data generated by a digital tool used as part of the research.

The more sensitive the data, the more robust the protective measures must be. Even before implementing data collection tools, it is helpful to ask yourself a few questions:

• Why do we need this data?
• Is it truly necessary?
• Who will have access to it?
• How long will it be retained?
• Does the research protocol or the ethics committee impose any specific requirements?

In many cases, limiting data collection to what is strictly necessary is already sufficient to reduce risks.

Several approaches can be used to reduce the risks associated with personal information. However, not all of them provide the same level of protection or meet the same needs.

Information that could identify an individual is permanently deleted. When done correctly, it should no longer be possible to re-identify a participant.

Direct identifiers are replaced with a code or a unique identifier. However, the data can be re-linked to an individual using a key stored separately in a secure environment.
This approach is frequently used in research projects because it allows for longitudinal follow-up or the addition of new data for the same participant.

Information is distributed across multiple systems or datasets to limit the ability to reconstruct a participant’s complete profile.

Certain information is intentionally modified, obscured, or generalized to reduce the risk of identification while preserving its analytical value.

Encryption protects data while it is stored or in transit. It is now an essential best practice, but it does not replace anonymization or pseudonymization. Encrypted data remains personal information if it can be linked to an individual after decryption.

The choice of method depends on the research objectives, regulatory requirements, and the acceptable level of risk.

Research projects are not automatically exempt from privacy obligations.
In Quebec, Law 25 strengthens organizations’ responsibilities regarding governance and privacy. Depending on the context in which the data is collected and the institution responsible for the project, several requirements may apply.
For example, it may be necessary to:

• limit data collection to only what is strictly necessary;
• implement appropriate security measures;
• control access to data;
• document governance practices;
• protect personal information throughout its lifecycle.

At the same time, universities, research centers, and healthcare institutions often have their own institutional policies. Research ethics committees also evaluate the measures in place to protect participants, limit the risks of re-identification, and ensure responsible data management.
Compliance therefore depends not only on the tool used, but on the overall practices surrounding the collection, use, retention, and destruction of data.

A common mistake is to view security as a final step.
In reality, the protection of personal information should be considered from the very beginning of the research project.
This may include:

• the choice of technologies used;
• access management;
• authentication mechanisms;
• backups;
• data encryption;
  logging of important actions.

The earlier these elements are integrated, the easier it is to implement a secure solution that meets the project’s requirements.

Data hosting is a major consideration in many research projects. Before choosing a provider or platform, it is important to assess:

• where the data will be hosted;
• which laws apply to this data;
• who might potentially have access to it;
• what safeguards the provider offers.

These factors can impact regulatory compliance, institutional requirements, and the conditions for ethics committee approval.

Protecting data doesn’t just mean storing it securely.
It also requires considering the data’s entire lifecycle:

• how it is collected;
• how it is used;
• who can access it;
• how it is transferred;
• how long it is retained;
• when and how it is destroyed.

Defining these rules from the outset makes project management easier and helps ensure compliance with legal and ethical requirements.

Participants agree to share personal information because they understand the research objectives and the measures put in place to protect their data. In particular, they should be informed of:

• the data that will be collected;
• the purposes of this collection;
• the individuals who will have access to the information;
• the terms and conditions for data retention;
• their rights, in accordance with the applicable legal and ethical framework.

Clear communication helps build trust in the study and promotes informed participation.

No single platform or digital solution can guarantee perfect protection of personal information on its own.
Technology plays a vital role, but processes, governance, institutional policies, and the practices of research teams remain just as important.
Data protection depends as much on the decisions made by researchers as on the tools they use.

Office of the Privacy Commissioner of Canada
Law 25 (Quebec) – Quebec Access to Information Commission
Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans – TCPS 2
Effective Date of the Anonymization Regulations

This article was written in collaboration with the FJNR team and edited by Mélanie Guérin.