Privacy & Confidentiality
Participants give you their data trusting that you will ask for no more than you need, keep it safe, and never let it harm them. Meeting that trust means meeting a set of specific, checkable duties, and the first is using the right words. "Anonymous," "confidential," and "pseudonymized" mean different things, and promising the wrong one on a consent form is itself a failure. This lesson defines the three terms, sets out the data-protection rules a student has to follow, and explains when confidentiality can be broken.
Three words that are not synonyms
People often use these words loosely, but the differences decide what you are allowed to promise:
- Anonymous. The data were never linked to identities, or every link has been irreversibly destroyed. No one, not even you, can trace a response back to a person. In this strict sense, anonymous data are no longer "personal data" at all, so they can be shared freely.
- Confidential. The data are identifiable (you know who said what), but you promise to protect that link and never disclose individual responses. Most interview and clinical studies are confidential, not anonymous.
- Pseudonymized. Direct identifiers are swapped for a code, but a separate key still links codes back to people. This is reversible by design (handy for follow-ups), so the data are not anonymous while the key exists. It protects participants only if the key is stored separately, under tighter access.
So don't write "your responses are anonymous" on an informed-consent form for a study where you can still identify anyone. If you hold a name, an email, a code-to-name key, or even a video, your data are confidential, not anonymous.
Your duties under data-protection law
You don't need to be a lawyer, but a few principles from data-protection law such as the GDPR apply to almost any study that collects data about people, and reviewers expect you to follow them:
- Data minimization. Collect only what your research question needs. Every extra variable (a birth date "just in case," a full address, an IP log) is something you now have to protect, and something that could help someone re-identify a participant.
- Purpose limitation. Use the data only for the purpose participants agreed to. Repurposing last year's dataset for a new question, or handing it to a third party, generally needs fresh consent or ethics approval.
- Storage limitation (retention). Keep identifiable data only as long as the study justifies, then delete or fully anonymize it. "Indefinitely, in case it's useful" is not a retention plan.
- Special-category data. Health, sex life, ethnicity, religion, political views, biometrics and genetic data get extra legal protection. If your study touches them, and a lot of psychology and health research does, the bar for storage and justification is higher.
Storing data like it matters
Most breaches aren't dramatic hacks. They're a laptop left on a train, a shared drive with the wrong permissions, or a spreadsheet emailed to the wrong "Sam." Good habits for a student project:
- Keep participant data out of email and personal cloud accounts. Use your institution's approved, access-controlled storage, not your personal Google Drive or a USB stick in your bag.
- If you pseudonymize, store the code-to-name key in a different, more restricted place than the coded responses: never the same spreadsheet, never the same folder.
- Password-protect and encrypt files with identifiable data, and give access only to the named research team, not "whoever's helping out."
- Check where third-party tools send data. A free survey site or transcription service is a data processor, so know where it stores data and whether it's covered by your institution's agreement before you upload real responses.
When confidentiality can be broken
Confidentiality is a strong promise, but not an absolute one. If a participant discloses a credible, specific risk of serious harm to themselves or an identifiable other, or in certain mandatory-reporting situations, the duty to prevent harm can override confidentiality. Handle this by planning for it: state the limit in the consent form up front ("we will keep what you tell us confidential, except if we learn of a serious risk of harm"). Then, if it ever happens, you disclose only what's necessary, to the appropriate person, and you told participants this could happen before they agreed.
Sort the situations
Below are eight everyday data-handling situations from a student project. For each, decide whether it's fine, risky (technically workable but asking for trouble), or a breach of privacy duties, then check the rule that decides it. How supposedly de-identified data get re-identified is covered in Data Privacy Basics.
🗂️ Fine, risky, or a breach?
Classify each situation, then reveal the rule that decides it.
Anonymous or confidential? Before you promise "anonymous," ask whether you could identify a participant if you had to. If you could (because you hold a name, a code key, a recording, or a small unique subgroup), promise confidential instead, and protect the link between the data and the people.
Why it matters: a privacy failure can ruin an otherwise careful study and, worse, expose the people who trusted you. The safeguards are routine and easy to learn: collect less, store it properly, keep the key separate, delete on schedule, and tell participants in advance about the one situation where you would have to break confidentiality.
Common questions
Can I share my data publicly if I promised confidentiality?
You can share only what your consent form covers, so decide this before you collect data, not when a journal asks. Data-sharing requirements and confidentiality promises are both reasonable, but they conflict if you write the consent form as though sharing will never happen. There are three ways to make sharing possible, in order of preference. Ask for permission up front: a consent form can say that de-identified data may be shared for future research, and most participants agree. Share an anonymized subset, remembering that removing names is not anonymization and that quasi-identifiers usually need to be generalized first. Or use controlled access, where a repository holds the data and other researchers apply for them under set terms; this is standard for sensitive and clinical data. You cannot promise confidentiality without qualification and then decide later that sharing counts as an exception. Writing "data available on request" is no substitute for planning this in advance.
Is deleting participants' names enough to anonymize a dataset?
No. Removing direct identifiers like names and emails only de-identifies the data. Quasi-identifiers such as age, sex, postcode, job, or dates can still identify people in combination. A well-known result found that ZIP code, birth date and sex uniquely identify 63% of Americans on 2000 census data (87% on the 1990 census, the figure usually quoted). Small unique subgroups are especially exposed: a single 62-year-old man in a small clinic sample is effectively named. Anonymization means there is no realistic path back to an individual. That usually requires generalizing or suppressing quasi-identifiers (age → age band), not just deleting the name column. How re-identification works is covered in Data Privacy Basics.
When am I allowed to break confidentiality I promised participants?
Confidentiality is a strong promise but not an absolute one. If a participant discloses a credible, specific risk of serious harm to themselves or an identifiable other, or something that triggers a mandatory-reporting duty, the obligation to prevent harm can override it. Plan for this in advance. State the limit in the consent form (for example, 'we will keep what you tell us confidential, except if we learn of a serious risk of harm'), so participants know the boundary when they agree. If it ever happens, disclose only what is necessary, and only to the appropriate person. Never promise absolute confidentiality, because you may not be able to keep that promise.