Best practice and legal compliance for consent and data storage

Use this guidance when you are preparing to carry out user research.

We get consent and store research data with care for two reasons.

• It often includes personal information so we need to follow data protection laws and regulations.
• Even if we're not collecting any identifiable data we should adopt good practice in research ethics. This means that we need to get people's consent and be clear about exactly how we'll use their information.

Send out consent forms in advance

Consent forms contain quite a lot of information. It’s good practice to allow your research subjects plenty of time to read and sign it.

If you send the form to them via email and they reply, that implies consent. You’ll need to save and store the email in a way that makes it easy to track. Interviewees can request that you find and delete their records at any time.

Print out copies to carry with you/read declarations over the internet 

Timescales may mean you don’t have enough time to send forms out in advance. Have printed copies on hand as the next best option. Allow at least five minutes for interviewees to read through and sign the form if you are with them. If you are reading online, encourage them to ask you questions and make sure they have time to think about what you're asking.

Records are easier to track if you scan printed forms and save them digitally.

Secure consent for quick interviews

Quick five minute interviews in a public space such as a café or waiting room are also known as guerilla testing. In these situations it can be difficult asking people to sign a form. There are three easy steps to secure verbal consent.

1. Record only the necessary details for your research
2. Ask for and get verbal consent
3. Write ‘verbal consent given’, your initials, and the date of consent in your notes

If you don’t keep any personal details or identifying facts on file there’s no need for a consent form. This approach can also work for online interviews if you don’t need any personal information as part of the research.

Storing research data 

The general principle is to keep as little information as you possibly can. When specific personal or identifying information is relevant to your project you will need to keep a record of it.

Note taking best practice

Things to consider when taking notes during a research interview or session.

• Try and keep any identifiable information out (names, locations, organisation names).
• You'll need to be able to track your notes back to a named individual in case they ask to have their information deleted.
• Use a key (or code) to link an interview to a person. Store the key separately to the interview notes to protect that person’s data. If you don’t have any identifiable data in your notes it’s already anonymous information. You don’t need to keep a key.
• Transfer any notes on paper to digital format as soon as you can. Shred the physical pages.

Deleting the records

• Decide how long you need to keep the data for, tell people and stick to that. Keep the time as short as you can. User research information will soon be out of date anyway.
• Keep a record of the dates you started and finished the research, and work out what the deletion date will be.
• Set a calendar reminder to delete the notes and consent forms in two years. 

Consent forms help users to understand the purposes of your research and how you'll use the data collected during that research.

• Why we do research. Have you outlined what you're hoping to understand as a result of the research?
• How users will take part. Do your participants know what type of research you're carrying out and how you'll do it? For example, is it an interview or software test? Will you take notes or recordings?
• How you will use this research. Have you made it clear what you're going to use the results for? Do participants know if you plan to share the results and who with?
• How you will store data. Be clear on where you'll store the data. Especially if you're using third-party software that stores data outside of the UK and European Economic Area.
• How long you will store data for. Think about how long you actually need to keep the data for and confirm that with your users. Users can ask for a copy of their data and request that you delete it.
• What your consent declaration looks like. Be sure to include opt-in tick boxes to make sure participants are comfortable with all of their consent choices.

Google form template

If you use google forms you can copy and adapt this template.

How to use this online consent form

• Make a copy of the form by clicking on the link
• Edit the content in brackets so that it contains your charity’s details  
• Check everything against your charity’s safeguarding policies

Sending out the online consent form

There’s an extra option to pre-fill the consent form using your interviewees’ data. Sending forms this way saves interviewees time and effort. 

• Click on the three dots in the top right of the screen and click ‘get pre-filled link’.
• Fill in your interviewee’s data and click ‘get link’.
• Click on ‘copy link’ at the bottom of the screen.
• Send the link to your interviewee.
• Wait for them to submit their consent form. Their data is automatically stored in your drive.

Get the Google Form template.

Word template

You can use this template to create your own form. Send it as a text document or hand it out as a printed page. You can also use the information to create your own version in your preferred survey tool.

To learn more about data protection laws and regulations use our three part guide.