UK GDPR Compliance for User Research Participants

UK GDPR compliance in user research: what needs deciding

UK GDPR compliance for user research participants begins before the first session and continues after findings are shared. Recruitment details, screener responses, recordings, notes, prototype entries, incentives and clips may each need different controls.

This is practical guidance, not legal advice. Ask your data protection officer (DPO) or legal adviser to approve the lawful basis, any special-category assessment and supplier arrangements for your study. An agreement to take part is not automatically consent as an Article 6 lawful basis: the ICO says that consent to participate in research is distinct from consent as a UK GDPR lawful basis. ICO guidance

Use the Research Participant Data Lifecycle Matrix below before fieldwork. List every data item, then assign its purpose, owner, basis, access, retention trigger and action. Our Research Operations guidance can help you make this a repeatable part of study planning.

Map the data before writing a consent form

Start with the data rather than the form. Participant information cannot be clear until you know what you will collect, where it will go and when it will be removed.

Inventory items separately:

• Contact details for invitations and scheduling.
• Screener responses and eligibility decisions.
• Session recordings and transcripts.
• Researcher notes and prototype inputs.
• Incentive-payment administration.
• Identifiable clips and other shareable outputs.
• Anonymised findings and aggregate insight summaries.

The GOV.UK Service Manual advises teams to treat notes, recordings and other research data as personal data. GOV.UK guidance

Apply data minimisation: collect only what answers the research question or administers participation. For example, an email used to schedule a session need not sit beside its recording. If you recruit user research participants, keep recruitment records separate from study material where your workflow allows it.

Flag health, disability, ethnicity, biometric information and children’s data early. If special-category data may be involved, the controller needs both an Article 6 basis and a relevant Article 9 condition; seek specialist review rather than applying a standard answer. This matters when you recruit disabled participants for accessibility research: ask only for information the study genuinely needs.

Do not promise anonymity if someone could still be identified through a recording, a rare role, a quotation or linked records. Use “pseudonymised” where a participant ID can be connected back to an individual.

Choose and document the lawful basis separately from participation consent

Document the purpose and necessity of each processing activity before choosing a lawful basis for UX research. Consent is not the default answer.

The ICO says the appropriate basis depends on context. Private and third-sector organisations may assess legitimate interests for some research; public authorities may assess public task where processing is necessary for their functions. Neither basis is automatic. Where legitimate interests is being considered, document the purpose, necessity and balancing assessment of people’s interests and rights.

Where UK GDPR consent is the basis, withdrawal must be operationally possible. The team needs a way to find the applicable data, stop relevant processing and assess whether deletion or anonymisation is required. Do not choose consent as a basis if the planned workflow cannot support that consequence.

Participation should still be voluntary, informed and free from pressure when another Article 6 basis applies. The participant information explains the study; the decision record explains the controller’s basis for processing data.

Build a participant information sheet and granular agreement

Give people clear information early enough for them to ask questions. A GDPR participant information sheet should explain:

• the controller’s name and contact details;
• the study purpose and participant activities;
• data categories, including recordings and prototype entries;
• recipients and processors;
• international transfers, where applicable;
• the retention period or criteria used to set it;
• relevant rights and the ICO complaint route; and
• how to withdraw from participation or make a data request.

The GOV.UK Service Manual says teams must retain evidence of each participant’s agreement and what they agreed to. GOV.UK guidance

Use distinct optional choices for materially different activities, such as recording, use of an identifiable video clip or future-study contact. One signature should not hide those choices.

Provide accessible formats and a workable verbal-agreement route where appropriate. Link evidence to a participant ID rather than repeating unnecessary personal details in file names.

Assess and disclose external recruitment, transcription and AI-notetaking services before the study begins. Check contractual roles, access, storage location and onward processing. Our guide to AI notetaker consent and privacy in user research outlines questions for that review.

Set retention, sharing and deletion rules teams can execute

A retention rule needs a trigger and an owner. “Keep for as long as necessary” is not an instruction a team can carry out.

The ICO states that UK GDPR does not set fixed time limits for different types of data. Retention must be justified against the processing purpose. ICO storage-limitation guidance

Set separate rules for recruitment records, recordings, transcripts and notes, agreement evidence, incentive records and anonymised findings. For each, record a purpose-led period or review point, a deletion or anonymisation action, and an accountable owner. Share through approved storage and role-based access. Give wider stakeholders anonymised extracts where feasible; an identifiable clip carries a different sharing risk from a theme in an insight report.

Use this withdrawal and rights runbook:

1. Authenticate and log the request.
2. Use the participant ID to locate linked data.
3. Stop applicable processing while the request is assessed.
4. Check the documented basis and any applicable exception with the DPO or legal adviser.
5. Delete, anonymise or otherwise action the request.
6. Record the decision, action and response.

Withdrawal of consent is a ground for erasure where consent is the lawful basis, subject to applicable exceptions. ICO right-to-erasure guidance

Payment records may have separate administrative retention requirements. Plan them apart from research material and review user research participant incentives in the UK with your finance process.

Worked example: complete the Lifecycle Matrix for one remote interview

This hypothetical example shows how a UK product team could document one remote interview. It is a planning aid, not a lawful-basis template.

Copy this blank worksheet into a research plan, repository or ResearchOps system:

If you are deciding when to outsource user research, add agency access, recipient and processor checks to the same record.

Before fieldwork, review the purpose, minimisation, Article 6 and Article 9 decisions, participant information, supplier arrangements, retention action and rights-request route.

Put the controls into every study kickoff

Use the same sequence for each study: inventory data, document the basis and conditions, prepare participant information, configure sharing and retention, then test withdrawal handling.

Bring in DPO or legal review early for vulnerable participants, special-category data, cross-border processing, novel tools and studies where withdrawal may be difficult to action. A completed matrix gives the team a study-specific record of data locations, participant expectations and deletion ownership. Add it to your Research Operations hub kickoff checklist.

Frequently asked questions

Do user research participants always need to give GDPR consent?

No universal answer applies. Voluntary, informed agreement to participate is distinct from consent as an Article 6 lawful basis. The controller should document an appropriate basis for the specific processing and seek DPO or legal advice where needed.

What lawful basis should a private company use for UX research?

There is no standard basis for every private-company study. Where legitimate interests is considered, assess the purpose, necessity and balance of interests and rights. Record the decision for the actual processing rather than copying a previous study’s approach.

How long can we retain user research recordings in the UK?

UK GDPR sets no universal period. Set a purpose-led retention rule, review point and deletion or anonymisation action. Treat raw recordings and genuinely anonymised findings as separate records.

What happens when a participant withdraws from user research?

Use the participant ID to find relevant data, assess the request against the documented basis and applicable rights, then record the outcome. Escalate exceptions or uncertainty to the DPO or legal adviser.

---

About Glasgow Research — Glasgow Research helps B2B SaaS teams turn customer and market research into product decisions. Work with us.