The Startup Series: 2 - GDPR and Market Research

It might seem strange to look at GDPR before consider research tools and research design. But having this in mind early, helps us consider and plan research carefully.

The Data Protection Act is being replaced by the General Data Protection Regulation. It is an EU regulation that will begin 25 May 2018. The aim of the regulation is the protect citizens’ data privacy.

For startups, GDPR will affect businesses in different ways and it is worth reading through the official documentation.

GDPR and Market Research

From a market research perspective, the GDPR will have a big impact. Consent is key; people must show that they have been given the opportunity to fully understand the research and how their data will be used. In academia, for qualitative research, it is usual to produce a one-pager brief to show the aim of the research and to provide the individual with an overview of their rights as a participant (for example, the right to withdraw at any time). This one-pager is provided to the individual with 24 hours minimum to read and digest it with ample opportunity to ask questions.

Any data provided by the individual to set up an interview will need to be documented where it is transparent that people are providing their personal data for setting up interviews only and will not be shared.

When the interview occurs, participants must sign to show that they have consented to the interview, they understand the purpose of the interview and their rights as a participant. Consent is an ethical and now legal consideration to research.

All aspects of market research must be documented and shown that consent has been provided by the participant. All data should be securely stored and destroyed once the project is finished.

Consent Form

When doing primary research, surveys, interviews or focus groups a consent form can provide an overview of these rights and the use of the data. The consent form must include:

  • The purpose of the project
  • Participation is completely voluntary
  • The participant can withdraw at any time
  • All data will be anonymised and confidential
  • The use of the data (for a report, publications etc)
  • Permission to be recorded or photographed

The participant must read these and for face-to-face research, sign and date the form. For a survey, the participant will accept these when continuing with the questions. There cannot be any ambiguity in the consent process.

Storing Data

All the data collected must be stored in a secure way, in line with the company's Privacy Policy. It must be password-protected and encrypted with limited individuals having access to the data. The data must be kept for a minimum period as per the Privacy Policy and destroyed at the end of this period.