Privacy & Confidentiality
People hand you their data on trust: that you'll ask for no more than you need, keep it safe, and never let it come back to bite them. Meeting that trust isn't vague good intentions; it's a set of specific, checkable duties, and getting the words right is the first of them. "Anonymous," "confidential," and "pseudonymized" are not interchangeable, and promising the wrong one on a consent form is itself a failure. This lesson pins down the definitions, the data-protection rules a student actually has to follow, and where the duty of confidentiality reaches its limit.
Three words that are not synonyms
These get used loosely all the time, and the differences decide what you're allowed to promise:
- Anonymous. The data were never linked to identities, or every link has been irreversibly destroyed. No one, not even you, can trace a response back to a person. Truly anonymous data are no longer "personal data" at all, which is why they can be shared freely.
- Confidential. The data are identifiable (you know who said what), but you promise to protect that link and never disclose individual responses. Most interview and clinical studies are confidential, not anonymous.
- Pseudonymized. Direct identifiers are swapped for a code, but a separate key still links codes back to people. This is reversible by design (handy for follow-ups), so the data are not anonymous while the key exists. It only protects if the key is stored apart, under tighter access.
The practical upshot: don't write "your responses are anonymous" on an informed-consent form for a study where you can still identify anyone. If you hold a name, an email, a code-to-name key, or even a video, the honest word is confidential.
Your duties under data-protection law
You don't need to be a lawyer, but a handful of GDPR-flavored principles apply to essentially any study collecting data about people, and reviewers expect you to honor them:
- Data minimization. Collect only what your research question needs. Every extra variable (a birth date "just in case," a full address, an IP log) is a liability you now have to protect and a re-identification handle you didn't need.
- Purpose limitation. Use the data only for the purpose participants agreed to. Repurposing last year's dataset for a new question, or handing it to a third party, generally needs fresh consent or ethics approval.
- Storage limitation (retention). Keep identifiable data only as long as the study justifies, then delete or fully anonymize it. "Indefinitely, in case it's useful" is not a retention plan.
- Special-category data. Health, sex life, ethnicity, religion, political views, biometrics and genetic data get extra legal protection. If your study touches them, and a lot of psychology and health research does, the bar for storage and justification is higher.
Storing data like it matters
Most real breaches aren't dramatic hacks. They're a laptop left on a train, a shared drive with the wrong permissions, or a spreadsheet emailed to the wrong "Sam." Student-scale good habits:
- Keep participant data off email and personal cloud dumps. Use your institution's approved, access-controlled storage, not your personal Google Drive or a USB stick in your bag.
- Separate the key from the data. If you pseudonymize, the code-to-name key lives in a different, more restricted place than the coded responses — never the same spreadsheet, never the same folder.
- Encrypt and limit access. Password-protect and encrypt files with identifiable data; give access only to the named research team, not "whoever's helping out."
- Check where third-party tools send data. A free survey site or transcription service is a data processor, so know where it stores data and whether it's covered by your institution's agreement before you feed it real responses.
When confidentiality can be broken
Confidentiality is a strong promise, but not an absolute one. If a participant discloses a credible, specific risk of serious harm to themselves or an identifiable other, or in certain mandatory-reporting situations, the duty to prevent harm can override confidentiality. The ethical way to handle this is not to be caught out by it: state the limit in the consent form up front ("we will keep what you tell us confidential, except if we learn of a serious risk of harm"). Then, if it ever happens, you disclose only what's necessary, to the appropriate person, and you told participants this could happen before they agreed. A limit that participants knew about in advance is honest; a surprise breach is not.
Sort the situations
Below are eight everyday data-handling situations from a student project. For each, decide whether it's fine, risky (technically workable but asking for trouble), or a breach of privacy duties — then check the rule it turns on. The mechanics of how supposedly de-identified data get re-identified are covered next door in Data Privacy Basics.
🗂️ Fine, risky, or a breach?
Classify each situation, then reveal the rule it hinges on.
Say the true word. Before you promise "anonymous," ask whether you could identify a participant if you had to. If the answer is yes, because you hold a name, a code key, a recording, or a small unique subgroup, the honest promise is confidential, and your job is to protect that link, not to mislabel it.
Why it matters: a privacy failure can undo an otherwise careful study and, worse, expose the very people who trusted you. The reassuring part is that the defenses are mundane and learnable: collect less, store it properly, keep the key separate, delete on schedule, and be upfront about the one situation where you'd have to break confidentiality. Do those, and you've met the duty that the trust was built on.
Common questions
Can I share my data publicly if I promised confidentiality?
Only what your consent covers, which is why this has to be decided before you collect rather than when a journal asks. Data-sharing requirements and confidentiality promises are both reasonable and they collide badly if you write the consent form as though sharing will never happen. Three routes out, in order of preference. Ask for it up front: a consent form can say that de-identified data may be shared for future research, and most participants agree. Share a genuinely anonymized subset, remembering that removing names is not anonymization and quasi-identifiers usually need generalizing first. Or use controlled access, where the data sit in a repository and other researchers apply for them under terms, which is standard for sensitive and clinical data. What you cannot do is promise confidentiality without qualification and then decide later that sharing counts as an exception, and "data available on request" is not a substitute for having thought about it.
Is deleting participants' names enough to anonymize a dataset?
No. Removing direct identifiers like names and emails only de-identifies the data; quasi-identifiers such as age, sex, postcode, job, or dates can still pin people down in combination. A well-known result found that ZIP code, birth date and sex uniquely identify 63% of Americans on 2000 census data (87% on the 1990 census, which is the figure usually quoted), and small unique subgroups are especially exposing — a single 62-year-old man in a small clinic sample is effectively named. Genuine anonymization means there is no realistic path back to an individual, which usually requires generalizing or suppressing quasi-identifiers (age → age band), not just crossing out the name column. The mechanics of how re-identification works are covered next door in Data Privacy Basics.
When am I allowed to break confidentiality I promised participants?
Confidentiality is a strong promise but not an absolute one: if a participant discloses a credible, specific risk of serious harm to themselves or an identifiable other, or triggers a mandatory-reporting duty, the obligation to prevent harm can override it. The ethical way to handle this is to plan for it, not be ambushed by it. State the limit in the consent form up front (for example, 'we will keep what you tell us confidential, except if we learn of a serious risk of harm'), so participants agree knowing the boundary. If it ever happens, you disclose only what is necessary, to the appropriate person, and no more. A limit disclosed in advance is honest; a surprise breach of an absolute-sounding promise is not.