Ethics in qualitative research: consent, confidentiality and data

A significant compliance gap can exist between formal ethical guidelines and actual fieldwork execution. A review of 108 qualitative studies conducted using communities and social media platforms found that only 59.3% sought formal ethical approval, only 45.3% mentioned informed consent, and just 12.9% explicitly documented obtaining it. While these figures reflect academic literature, operational vulnerabilities in commercial market research can tell an identical story.

Maintaining ethics in qualitative research protects participant welfare and ensures data integrity. Research teams are legally and operationally accountable for three pillars: informed consent, confidentiality protocols, and secure data handling. Managing these requirements requires a clear understanding of current regulatory updates, particularly regarding how participant data interacts with artificial intelligence (AI).

TL;DR

What is ethics in qualitative research: It is a framework for protecting participant welfare, securing valid agreement, preventing reputational or social harm, and maintaining data security across the study process.

A key 2026 regulatory milestone: The European Data Protection Board's (EDPB) Guidelines 1/2026 serve as the active compliance blueprint for research-related data processing under GDPR.

Confidentiality isn’t the same as Anonymity: Confidentiality secures how identifiable research files are stored, whereas true anonymity means entirely removing any identifiers (name / location, etc.).

Yes, ‘continuous consent’ is a thing: Informed consent requires an ongoing dialogue during the interview lifecycle, not just a checked box on a pre-session registration form.

AI-transparency is expected: Disclosing whether participant transcripts train third-party large language models (LLMs) is a mandatory component of modern consent protocols.

Reflexive analysis protects participants: Using reflexivity prevents a researcher's personal assumptions from distorting participant narratives during synthesis.

What ethical considerations drive qualitative research

Ethical considerations in qualitative research extend beyond securing a standard Institutional Review Board (IRB) qualitative research sign-off. Comprehensive qualitative research ethics guidelines protect the rights of participants and minimise systemic data risks. In applied enterprise and consumer studies, these guidelines translate into four operational mandates:

Protecting participant groups from professional, reputational or social harm.

Ensuring voluntary participation remains active throughout the interview, rather than treating it as a fixed agreement signed at the recruitment stage.

Transparently managing the power dynamics between the interviewer and the participant.

Handling raw media files with the exact security measures that were promised to stakeholders.

Typically, unaddressed ethical issues in qualitative research typically emerge in three areas:

Consent execution

Identity management

Data management

Consent execution in a qualitative study

Building an uncompromised informed consent qualitative study requires treating consent as a continuous conversation. Comprehensive informed consent in research requires providing explicit clarity on several points:

Disclosing the exact purpose, scope, and duration of the study in plain language

Disclosing mechanisms used to record, store, and analyse the conversation

Ascertaining internal and external teams that will have access to raw media files and transcripts.

Protecting the participant’s absolute right to pause the session or withdraw completely at any point.

Disclosing whether AI tools will process participants’ responses, and how data collected will be used.

86% of studies reporting informed consent obtained those agreements digitally. Even though it's digital, it has the same legal rules and responsibilities as signing a paper form.

Because qualitative research uses evolving, semi-structured discussion guides, field teams must monitor participant comfort levels continuously. If a conversation turns toward unexpected personal or operational vulnerabilities (like undisclosed financial hardship, an ongoing internal dispute, or an unplanned health disclosure), the interviewer should pause and allow the participant to reaffirm or adjust their consent parameters.

Identity management in a qualitative study

Studies show that 68% of qualitative studies using participant quotes present them verbatim, while 32% use strategic paraphrasing to prevent identification.

Protecting participant identity is interchangeably described as maintaining 'confidentiality' and 'anonymity'. However, these are distinct concepts. Both protect participant rights in qualitative research, but each requires a different technical workflow.

Confidentiality in qualitative research

Promising confidentiality in qualitative research means the research team can identify the participant (for analysis purposes) but implements strict safeguards to ensure their identity is never exposed in client deliverables or public reports. This is achieved by taking steps like limiting data access strictly to authorised team members.

Anonymity in qualitative research

Promising anonymity in qualitative research means that no one, including the analysis team, can trace a specific data point back to a concrete individual. True anonymity remains difficult to achieve in online qualitative research. The descriptive richness of personal histories and unique behavioural narratives frequently makes a participant identifiable, despite their names being stripped from documents.

To preserve participant identity, teams use systematic de-identification workflows:

Rapid pseudonymization: Replacing all direct corporate and personal names with standardised alphanumeric codes immediately after the session.

Contextual sanitisation: Removing specific references to company size / geographic location / proprietary product / brand names before beginning qualitative data analysis.

Data management in a qualitative study

Maintaining robust data privacy in research is a foundational design decision. Modern data protection qualitative research protocols must align tightly with global regulatory standards.

GDPR qualitative research requirements

Possibly the most significant compliance standard for qualitative work in EU / EEA markets is the European Data Protection Board's (EDPB) Guidelines 1/2026. This framework establishes explicit compliance requirements for research-related data processing under the GDPR, clarifies the boundaries of broad consent, transparency mandates and purpose limitations across the entire data lifecycle.

GDPR compliance requires moving away from reactive audit defences, toward proactive data management. If your study includes individuals residing in EU / EEA, your workflow must respect fundamental data protections:

A clear, lawful basis for data processing must be established prior to study launch.

Participants retain the explicit right to access, rectify or permanently delete their personal records.

Every data sub-processor, including third-party transcription tools, translation services, and cloud hosting vendors, must be legally documented.

HIPAA qualitative research requirements

For healthcare, clinical, or pharmaceutical market studies in the United States, managing Protected Health Information (PHI) requires strict adherence to HIPAA guidelines. Research teams must secure an official Business Associate Agreement (BAA) with their software vendors and implement rigorous data security controls before processing any patient or provider data.

Ethics in online qualitative research and AI integration

The rapid integration of AI tools in text processing introduced distinct ethical challenges that older methodologies never had to consider. EDPB’s Guidelines 1/2026 address these technologies directly, requiring organisations to exhaustively assess qualitative research data before passing it through LLMs. General-purpose LLMs rarely guarantee complete data isolation. Hence, processing unredacted participant transcripts through public AI tools can constitute an unauthorised data exposure.

To maintain compliance during digital studies, a workflow must meet these requirements:

Consent protocols must explicitly inform participants if their voice, video, or text data will be processed by automated AI utilities.

Participants must be clearly notified if corporate stakeholders are monitoring live sessions, via virtual backroom environments.

Any AI-generated summary utilised in final deliverables must remain fully traceable to primary source data, to ensure verification and prevent algorithmic hallucination.

Ethical use of AI in qualitative data analysis also comes into play when conducting thematic analysis. Researchers must actively guard against confirmation bias, i.e. the tendency to select quotes that validate a stakeholder's preferred hypothesis, while discarding data points that challenge it. Practising reflexivity in qualitative research serves as a vital safeguard against this risk.

Reflexivity demands that analysts continuously examine how their own background, commercial incentives and personal assumptions impact analysis and interpretation. In practice, executing a reflexive analysis involves:

Maintaining a running methodology log that documents the rationale behind specific coding adjustments.

Clearly distinguishing between direct participant expressions and the researcher’s downstream interpretations.

Verifying that your final codelist mirrors the participant's organic terminology, rather than a pre-imposed framework.

A professional qualitative research platform must deliver across industry standards - verify GDPR compliance, ISO 27001 data security standards, HIPAA alignment, and explicitly guarantee that participant assets are never used to train LLM models.

Key Takeaways

Secure explicit permissions for video recording, live observer monitoring and AI transcript processing up front, and allow participants to opt out at any stage.

Never store real names or direct corporate identifiers in the same system that is used for thematic coding and qualitative analysis.

Ensure your data workflows comply with EDPB's updated guidelines regarding purpose limitation and sub-processor tracking.

Restrict your analysis to specialised platforms that explicitly isolate your data and protect it from public LLM training cycles.

Modern security infrastructure with flowres

Maintaining ethical integrity requires infrastructure built specifically for the demands of modern data protection laws. Using generic enterprise communication tools to manage sensitive qualitative insights can introduce severe compliance risks.

flowres' platform functions as a secure, completely isolated ecosystem designed for qualitative teams. By combining secure participant interactions, real-time automated transcription, compliance-driven analysis tools and slide-making capabilities, flowres.io ensures your research data is protected.

All participant data processed within the platform remains private, encrypted and is never utilised to train large language models. This design allows you to focus entirely on extracting deep insights, with full confidence that your participant rights and compliance obligations are completely protected.

30-min live session

Secure your research operations

Discover how flowres' architecture keeps your qualitative studies fully compliant with modern data laws.

Book a Demo

FAQs

What are the primary ethical considerations in qualitative research?

The core pillars include ensuring continuous informed consent, protecting participant confidentiality and ensuring data security compliance.

What is the difference between confidentiality and anonymity?

Confidentiality means the research team can identify the participant, but ensures their identity is hidden in all external outputs. Anonymity means the data cannot be linked back to the individual by anyone, including the researcher.

How do EDPB Guidelines 1/2026 impact qualitative studies?

The guidelines establish strict boundaries for research data under GDPR, specifying how organisations must manage broad consent, transparency, and data processing lifecycles.

Is processing qualitative transcripts through standard AI tools safe?

Standard consumer AI tools often retain inputs for model training, which can lead to compliance violations. Researchers should utilise platforms that guarantee zero-data retention.

What is reflexivity in qualitative analysis?

It is the active process where a researcher examines their own biases and assumptions, ensuring their interpretations do not distort the participant's original meaning.

Sources

Zhang, Y. et al. (2024). Reporting of Ethical Considerations in Qualitative Research Utilising Social Media Data on Public Health Care: Scoping Review. JMIR / PMC.
https://pmc.ncbi.nlm.nih.gov/articles/PMC11143395/