Informed Consent

"Whenever you do user research, you must get the participant’s ‘informed consent’. This means getting a record from them to show they understand your research and agree to take part."

There must be an understanding of:

• Who is doing the research
• Purpose of research
• What happens during research
• How results will be used
• Who you will share results
• Voluntary participation; withdraw consent at any time
• What data is collected
• How long data is kept
• What their rights are
• How to complain
• Data controller
• Data Processors

Additionally make known if session is being observed and by whom; whether session is recorded and how.

Data Management

GDPR "‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data."

For primary research the charity will act as the data controller.

• Must get Informed Consent
• Treat all research data as personal data
• Collect only what you need
• Agree a retention period
• Store research data securely
• Name and organise research data clearly
• Keep a record of consent with all data
• Stay within with the purposes and consent of the data
• Delete data when no longer needed

References

• https://www.gov.uk/service-manual/user-research/getting-users-consent-for-research
• https://www.gov.uk/service-manual/user-research/managing-user-research-data-participant-privacy
• https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/controllers-and-processors/what-are-controllers-and-processors/