User research

Collecting data from participants

We must collect data in a legal and transparent way. Clearly explain to participants what we will use data for and that we will use it for no other purpose.

Meet the regulations

The General Data Protection Regulation (GDPR) came into effect in May 2018.

When you do user research at the Ministry of Defence (MOD), remember that the regulations:

  • include strict rules around evidence of informed consent and withdrawal of consent
  • define personal data broadly, including online identification markers and location data
  • set out stronger requirements for documenting and auditing processes

The MOD Privacy Notice explains the sort of information you can collect from users and why.

To make sure your data management and privacy practices meet the regulations, get them reviewed by a data protection adviser. Ask your service owner to put you in touch with MOD's network of data protection advisers.

Whenever you do user research, you must get the participant’s informed consent. This means getting a record from them to show they understand your research and agree to take part.

Why you need informed consent

By getting informed consent, you’ll help make sure that:

  • participants understand what they’re signing up to, making your sessions more effective
  • your research is ethical
  • you comply with data protection law

How to get informed consent

What to tell participants

You must tell participants:

  • if you will be recording any audio or video portions of the research sessions
  • who any recording will be shared with
  • if anyone will be taking notes during the session
  • who any notes will be shared with
  • how long you plan to keep the session data and information

You must then ask the participant if they:

  • understand the main purpose of the research session
  • are happy to be contacted again for further research
  • have any questions about the session

Get participants to complete a consent form

Before you start, you must get participants to sign the MOD consent form. You need to add details about your research.

Share an understanding your participation sheet.

Your information sheet should include:

  • the types of questions you will ask
  • the digital service you are testing or discussing
  • the technology you plan to use for the research session
  • the classification of the research and what this means, especially if SECRET or above
  • how the user can withdraw from the current or future research

You can use this example of an understanding your participation sheet.

Only collect data that you need

Check that you are only collecting the data that you need to answer your research questions.

For example, you probably do not need to know someone’s sexual orientation when doing usability testing.

Protect sensitive data

Do not reveal any sensitive data about an individual when carrying out user research.

Sensitive data is any information that could cause the participant embarrassment or distress and which they can reasonably expect to remain private.

Types of sensitive data

Special category data

This is personal data that needs more protection because it is sensitive, as defined by General Data Protection Regulation (GDPR).

It covers data revealing someone’s:

  • racial or ethnic origin
  • may need help to use your service
  • political opinions
  • religious or philosophical beliefs
  • trade union membership
  • genetic data
  • biometric data
  • health
  • sex life
  • sexual orientation

Additional sensitive information, defined by MOD

Alongside special category data, the MOD Analysis Directorate considers some additional data sensitive.

This includes:

  • any data collected where a guarantee of confidentiality was given
  • nationality
  • age
  • marital status
  • cause of death, where this is not a matter of public record
  • benefit claims history or entitlement
  • photographs, videos or sound recordings in which individuals can be identified

Some personal data is not considered sensitive when captured on their own. These include a participant’s:

  • sex
  • rank or grade
  • full-time or part-time working status

For more information, check the MOD disclosure and confidentiality policy.

Protected characteristics

Special category data and protected characteristics are similar, but regulated differently.

Unless it is essential to your research, avoid collecting information on protected characteristics.

Special Category Data at the Information Commissioner’s Office

Updated March 2023