Research Ethics for Students: Consent, Privacy, and Integrity

Ethics approval is not paperwork you clear before the real work starts. It shapes your design. Here is what committees actually assess, and how to write a section that passes first time.

Most students treat ethics approval as an administrative gate between them and their data. Committees see it differently. They are assessing whether your design justifies the burden it places on participants, and a proposal that treats ethics as a form to complete usually reveals a design that has not thought about participants at all. The approval process is slow largely because so many applications arrive in that state.

The Three Principles Everything Rests On

Most institutional frameworks trace back to the same three principles, set out in the Belmont Report and echoed in the Declaration of Helsinki and national codes.

Principle	Means	In practice
Respect for persons	People decide for themselves, and those with reduced autonomy are protected	Informed consent, right to withdraw, safeguards for vulnerable groups
Beneficence	Maximise benefit, minimise harm	Risk assessment, adequate design, distress protocols
Justice	Burdens and benefits distributed fairly	Recruitment that neither exploits nor excludes a group unfairly

The justice principle is the one students most often overlook. Recruiting only from your own convenient population is a justice question as well as a sampling one, particularly if the group bearing the research burden is not the group who might benefit from it.

Does Your Project Need Approval?

Activity	Usually needs approval?
Interviews or surveys with people	Yes
Observation of people, even in public	Usually, and covert observation always
Analysis of existing personal data	Yes, secondary data is still personal data
Fully open, anonymised public datasets	Often not, but check rather than assume
Social media content	Contested. Often yes, particularly for private groups
Literature-only projects	No
Anything involving NHS patients, staff or data	Yes, and through a separate route

Two traps. Analysing data someone else collected does not exempt you, since the participants consented to their study and not to yours. And "it is publicly available" is not a decision, it is the start of one, because people posting publicly generally do not expect to become research subjects.

What Informed Consent Actually Requires

Consent is a process, not a signature. For it to be informed and freely given, the participant needs to understand what is being asked, and to be genuinely free to decline.

Purpose of the study, in plain language, at a reading level your participants actually have.
What participation involves, including how long it takes and what will be asked.
Risks and benefits, stated honestly. "There are no risks" is rarely true and reads as unconsidered.
Voluntariness, including that declining carries no penalty. This matters most where you have any power over the participant.
Withdrawal, how to do it, and crucially the point after which it becomes impossible.
Confidentiality, what will be kept private and the limits of that promise.
Data handling, storage, retention period, who has access, and what happens at the end.
Contact details for you, your supervisor and the complaints route.

The withdrawal cut-off is the item most often missing. Once data are anonymised and pooled you cannot extract one person's contribution, so say that at the outset rather than discovering it when someone asks.

The Power Problem

Consent is not free if declining feels costly. This applies more often to student projects than students realise. Researching your own students, your own patients, your own colleagues or your own team all raise it. So does recruiting friends, who may feel unable to say no.

Committees do not usually prohibit this. They expect you to recognise it and mitigate it, typically by having someone else make the initial approach, by making non-participation invisible to you, and by stating explicitly that participation has no bearing on grades, care or working relationships.

Anonymity and Confidentiality Are Not the Same

	Anonymous	Confidential
You know who participated	No	Yes
Responses linkable to a person	No, by anyone	Yes, by you
Withdrawal after submission	Not possible	Possible
Follow-up possible	No	Yes
Typical use	Anonymous online survey	Interviews with pseudonyms

Most interview studies offer confidentiality, not anonymity, and describing them as anonymous in your information sheet is a misstatement. Use the right word.

Note too that anonymisation is harder than removing names. In a small organisation, a job title plus a length of service can identify someone to their colleagues, who are precisely the readers most likely to try. Consider what your participants would recognise, not just what a stranger would.

Confidentiality Has Limits, and You Must State Them

You cannot promise absolute confidentiality. If a participant discloses risk of serious harm to themselves or others, or discloses certain criminal matters, you may have a duty to act. Professional codes in health, education and social work impose specific obligations.

Decide your position before fieldwork, put it in the information sheet in plain terms, and agree it with your supervisor. Discovering the question mid-interview, with a distressed participant in front of you, is the worst possible time to work it out.

Data Protection in Practice

Collect the minimum. Every extra personal field is a liability you must justify.
Pseudonymise early, and keep the key separate from the data, ideally on different systems.
Encrypt devices and files holding personal data. A lost unencrypted laptop is a reportable breach.
Use institutional storage, not personal cloud accounts, since your institution's agreements govern where data physically sit.
Set a retention period and actually delete at the end of it.
Check transcription services, including automated ones, since uploading a recording sends personal data to a third party.

Integrity Beyond the Approval Form

Ethics approval covers your treatment of participants. Research integrity covers your treatment of the evidence, and it continues after the fieldwork ends.

That means reporting all results including the inconvenient ones, not adjusting analyses until something reaches significance, describing your method as you actually conducted it rather than as you planned it, attributing authorship honestly, declaring conflicts of interest, and keeping data available for scrutiny. UKRI and equivalent bodies treat these as the core of research integrity, and universities apply the same standards to student work.

Common Mistakes and Fixes

Mistake	Fix
Applying for approval after starting	Approval must precede any data collection, including pilots
Information sheet written in academic English	Rewrite for your actual participants. Test it on someone
"There are no risks"	Identify realistic risks, including inconvenience and discomfort, and say how you handle them
No withdrawal cut-off stated	State the point after which withdrawal is impossible, and why
Calling a confidential study anonymous	Use the accurate term
Personal data on a personal laptop or cloud drive	Use institutional encrypted storage
Power relationship unacknowledged	Name it and describe your mitigation
Ignoring the timeline	Build months into the plan, especially for NHS or vulnerable-group research

Where Ethical Support Fits

Ethics committees would far rather advise before submission than reject afterwards, and most will answer a question about scope or consent wording if asked. Supervisors have usually written dozens of these applications. Departmental templates exist precisely so you do not draft an information sheet from nothing.

What stays yours is the conduct of the research. An approved protocol you then depart from is worse than one that was never approved, so if circumstances force a change, seek an amendment rather than proceeding and explaining later.

Frequently Asked Questions

How long does ethics approval take?

Weeks for a low-risk departmental review, months where an NHS or vulnerable-group route applies. Ask your department for typical timescales and plan backwards from your deadline.

Do I need approval for a pilot study?

Yes. Piloting with real participants is data collection, and collecting before approval is the most common serious breach in student research.

Can children participate?

Sometimes, with additional safeguards including parental or guardian consent alongside the child's own assent, and usually enhanced background checks. Expect a longer process.

What if a participant becomes distressed?

Have a protocol before you start: pause, offer to stop, and provide signposting to support services. Committees expect to see this written down.

Can I use social media posts as data?

It depends on the platform, the privacy setting and the sensitivity of the topic. Public availability does not equal consent to research use, so put the question to your committee rather than deciding alone.

What happens if I breach the approved protocol?

Report it to your supervisor and committee promptly. Self-reported deviations are handled far better than discovered ones, and concealment is treated as misconduct in its own right.

Your Next Step Today

Give your participant information sheet to someone outside your field and ask them to explain back what the study involves and what happens to their data. Wherever they hesitate, rewrite. That five-minute test catches more real problems than a second read by you ever will.

Trusted Sources

The Belmont Report, US Department of Health and Human Services, the source of the three principles. Accessed 11 August 2026.
World Medical Association, Declaration of Helsinki. Accessed 11 August 2026.
British Psychological Society, Code of Human Research Ethics. Accessed 11 August 2026.
UK Research and Innovation, Research integrity. Accessed 11 August 2026.
Health Research Authority, for research involving NHS patients, staff or data. Accessed 11 August 2026.

This is general study guidance, not legal or regulatory advice. Ethics requirements are set by your institution and national framework, so follow theirs.