Research Ethics, Privacy and Governance

Introduction

Market research gives entrepreneurs access to information about people, organizations, preferences, behavior, technologies and markets. That access creates obligations. A research project may be commercially valuable yet still be unacceptable if participants are deceived, personal information is collected unnecessarily, competitors’ intellectual property is misappropriated, or automated systems produce discriminatory conclusions.

Research ethics concerns the moral principles that govern the treatment of participants, communities, organizations and other affected parties. Privacy concerns people’s control over information about themselves and the conditions under which that information is collected, used, shared and retained. Governance converts these principles into decision rights, procedures, controls, records and accountability. In practice, the three are inseparable: ethical principles guide what should be done, privacy rules constrain how information may be handled, and governance ensures that commitments are implemented and auditable.

For entrepreneurs, these issues are strategic rather than merely administrative. A privacy breach can produce regulatory penalties, litigation, customer loss and reputational damage. Poorly designed research can also lead to invalid strategic decisions. Participants who feel manipulated or unsafe may withdraw, provide inaccurate answers or warn others against the organization. Conversely, transparent and fair research practices can improve data quality, stakeholder trust and long-term competitive legitimacy.

This chapter examines informed consent, confidentiality, intellectual property, data protection, responsible artificial intelligence and research governance. It uses a risk-based perspective suitable for graduate-level market research and competitor analysis. Laws differ across jurisdictions, so this chapter explains widely applicable principles rather than providing jurisdiction-specific legal advice.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish ethics, privacy, confidentiality, anonymity and data protection.
2. Design an informed-consent process that is understandable, voluntary and appropriate to the research context.
3. Apply principles of data minimization, purpose limitation, security, retention and participant rights.
4. Identify intellectual-property and confidentiality risks in primary and secondary market research.
5. Evaluate the ethical and governance risks of artificial-intelligence tools used in research.
6. Construct a proportionate governance framework for lawful collection, secure retention, transparent reporting and fair participant treatment.
7. Critically assess difficult cases involving vulnerable participants, covert observation, incentives, cross-border data and competitor information.

1. The Ethical Architecture of Market Research

1.1 Ethics, law and governance

Ethics asks whether an action is morally justified. Law establishes enforceable requirements created by a competent authority. Governance defines who may make decisions, what controls must operate, how exceptions are handled and how compliance is demonstrated. The three domains overlap but are not identical.

An action may be legal but ethically questionable. For example, a researcher may be able to obtain publicly visible information about an individual, yet combining many fragments to infer sensitive personal characteristics may be intrusive. Conversely, an ethically desirable practice may not be explicitly required by law, but it can still be essential to responsible professional conduct.

A defensible research project therefore asks four questions:

• Is the purpose legitimate and sufficiently important?
• Is the method respectful, necessary and proportionate?
• Are foreseeable harms prevented or reduced?
• Can the organization explain and evidence its decisions?

1.2 Core ethical principles

Several principles recur in research codes, data-protection regimes and professional practice.

Respect for persons requires recognition of participants’ autonomy, dignity and right to make informed choices. It is especially important where there is a power imbalance, such as research involving employees, students, patients, children or economically dependent consumers.

Beneficence and non-maleficence require researchers to pursue legitimate benefits while avoiding or minimizing physical, psychological, economic, social and reputational harm. A commercially useful result does not automatically justify exposing participants to risk.

Justice concerns the fair distribution of burdens and benefits. Researchers should not recruit disadvantaged groups simply because they are easy to reach, inexpensive to compensate or less able to object. Sampling should also avoid systematically excluding groups whose perspectives are relevant to the decision.

Respect for privacy recognizes that people may reasonably expect control over intimate, identifying or contextual information. Privacy is not limited to secrecy. It includes the ability to decide when, how and in what context information is observed or used.

Integrity and transparency require accurate representation of methods, limitations, sponsorship, incentives, uncertainty and conflicts of interest. Selective reporting, fabricated responses, undisclosed sponsorship and misleading visualizations undermine both ethics and research validity.

1.3 Ethical risk is contextual

The same method can have different ethical implications in different contexts. Recording a voluntary product interview with explicit permission is materially different from recording a conversation in a shelter, workplace or health-care setting. Public availability does not eliminate all ethical considerations. Researchers should assess the reasonable expectations of the people involved, the sensitivity of the information, the likelihood of re-identification and the consequences of disclosure.

2. Informed Consent

2.1 Meaning and purpose

Informed consent is an ongoing process through which a person receives adequate information, understands the material implications of participation, makes a voluntary decision and can withdraw without inappropriate penalty. A signed form is evidence of the process, not a substitute for it.

A consent process should normally explain:

• the identity of the researcher and sponsoring organization;
• the purpose and expected duration of the research;
• what participation involves, including recording, observation or automated processing;
• foreseeable risks, discomforts and potential benefits;
• how information will be used, stored, shared and reported;
• whether quotations or images may be published;
• compensation, reimbursement and any conditions attached to it;
• how to withdraw and what withdrawal can mean after data have been anonymized or incorporated into aggregate analysis;
• contact details for research questions, complaints and privacy requests.

Information must be understandable to the intended participants. A lengthy legal notice written in technical language may satisfy documentation requirements while failing the ethical purpose of informed choice. Layered notices, short summaries, translated versions, accessible formats and comprehension checks may be appropriate.

2.2 Voluntariness and undue influence

Consent is not genuinely voluntary when refusal carries an unreasonable penalty or participation is induced by disproportionate rewards. Compensation should recognize time, inconvenience and expenses; it should not exploit financial vulnerability. In employer-sponsored research, employees may fear that refusal will affect their employment. The researcher should separate recruitment from line management, avoid reporting identifiable individual responses to supervisors and communicate that participation is optional.

For children and adults who lack decision-making capacity, applicable law and institutional policy commonly require permission from an authorized representative and, where possible, assent from the participant. The standard should be adapted to developmental and cognitive circumstances rather than treated as a procedural formality.

2.3 Withdrawal and secondary use

Withdrawal rights should be explained realistically. If identifiable data remain linked to a participant, deletion may be possible. Once data have been irreversibly anonymized and combined into aggregate statistics, identifying and removing one person’s contribution may no longer be feasible. This limitation should be disclosed before participation.

Secondary use creates a further consent issue. Data collected to evaluate a prototype may not automatically be appropriate for training a model, selling to another organization or analyzing a new sensitive characteristic. Organizations should either obtain sufficiently broad and intelligible consent where lawful and ethical, or establish another valid basis and provide appropriate notice, safeguards and governance.

3. Privacy, Confidentiality and Anonymity

These terms are related but distinct.

Privacy concerns a person’s ability to control access to themselves and information about themselves. Confidentiality is an undertaking to restrict access or disclosure according to an agreed arrangement. Anonymity means that identity is not known or cannot reasonably be linked to the information. Pseudonymization replaces direct identifiers with codes, but the data remain personal if a key or other means can reconnect the record to an individual.

Researchers should not promise anonymity when IP addresses, device identifiers, voice recordings, free-text descriptions or small subgroup characteristics could permit re-identification. In a small executive sample, a statement such as “a senior manager in the only regional firm” may identify a person even without a name.

Confidentiality agreements are useful but not absolute. They cannot override legal reporting duties, court orders, safety obligations or the rights of data subjects under applicable law. Participant-facing language should avoid absolute promises that the organization cannot guarantee.

4. Data Protection by Design

Data-protection regimes differ, but several principles are broadly influential. The European Union General Data Protection Regulation, for example, emphasizes lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Other jurisdictions use different terminology and obligations. A graduate researcher must identify the law governing the organization, participants, processing location and service providers.

4.1 Purpose and lawful basis

Before collecting data, define a specific research purpose. “Future business use” is usually too vague to guide fair collection. Depending on the jurisdiction and context, processing may rely on consent, contract necessity, legal obligation, legitimate interests or another recognized basis. Sensitive or special-category data may require additional conditions.

Consent is not always the correct basis. It may be inappropriate where there is a power imbalance or where the organization needs to process information regardless of whether an individual agrees. Conversely, claiming legitimate interest does not remove the need for transparency, necessity assessment, balancing of impacts and respect for objections where applicable.

4.2 Data minimization and quality

Collect only information reasonably necessary for the stated purpose. If age bands are sufficient, do not collect exact birth dates. If regional trends are sufficient, do not collect precise addresses. Minimization reduces breach impact, storage cost and analytical distraction.

Data quality also has an ethical dimension. Inaccurate demographic variables can produce unfair segmentation, and outdated contact information can cause unwanted communications. Procedures should allow correction where appropriate and record important assumptions about missing, self-reported or inferred data.

4.3 Security controls

Security should be proportionate to sensitivity and risk. Typical controls include:

• role-based access and least privilege;
• multi-factor authentication;
• encryption in transit and at rest;
• separation of identifying information from research responses;
• secure transfer methods rather than personal email or unapproved file-sharing;
• audit logs and access reviews;
• tested backups and recovery procedures;
• staff training and confidentiality commitments;
• vendor due diligence and written data-processing terms;
• an incident-response plan.

Security is not achieved by a single tool. A password-protected spreadsheet may still be insecure if it is copied to unmanaged devices, shared broadly or retained indefinitely.

4.4 Retention and deletion

Retention should be linked to a defined purpose, legal requirements, research reproducibility needs and risk. A retention schedule should specify the record type, owner, location, retention period, deletion or anonymization method and any legal hold. Backups, exported datasets, transcripts, notebooks and vendor copies must be considered.

Deletion should be meaningful, not merely removal from a user interface. Where destruction is impossible or disproportionate, effective anonymization, access restriction and documented justification may be alternatives, subject to applicable law.

4.5 Data-subject rights and cross-border processing

Depending on the applicable regime, individuals may have rights to access, correct, delete, restrict or object to processing, and in some circumstances to receive portable data or challenge automated decisions. Procedures should assign responsibility, authenticate requesters and respond within legally required times.

Cloud platforms and transcription providers may transfer information across borders. Governance should identify processing locations, subprocessors, contractual safeguards and transfer mechanisms. A researcher should never assume that a free online tool is suitable for confidential interviews merely because it is convenient.

5. Intellectual Property and Competitor Information

Market research frequently uses reports, databases, websites, software, images, trademarks, survey instruments and interview materials. Access does not equal ownership, and public visibility does not automatically authorize copying, scraping, republishing or commercial exploitation.

5.1 Copyright and licensing

Copyright may protect written reports, photographs, diagrams, audio, video, software code and structured compilations. Researchers should check whether a source permits quotation, extraction, automated access, internal distribution or commercial use. Attribution is good practice but does not by itself cure infringement. Fair dealing or fair use rules vary by jurisdiction and are context-dependent.

5.2 Trade secrets and confidential information

A competitor’s confidential presentation, customer list, product roadmap or pricing formula should not be solicited or used improperly. Researchers must distinguish legitimate competitive intelligence—such as analyzing public filings, published product information and openly available customer reviews—from misappropriation, deception or inducement to breach confidentiality.

A participant may offer confidential information during an interview. The researcher should explain boundaries in advance, avoid requesting proprietary details, pause the interview if necessary and document how the information will be handled. If a former employee offers a competitor’s confidential material, accepting or retaining it may create legal and ethical exposure.

5.3 Ownership of research outputs

Contracts should clarify ownership and permitted use of recordings, transcripts, datasets, models, inventions, photographs and reports. In commissioned research, the client may own deliverables while the research firm retains background methods or reusable tools. Participants may retain rights in their image, voice, creative contribution or personal data. Ownership, license, attribution and confidentiality are separate issues and should not be conflated.

6. Responsible Use of Artificial Intelligence

AI can assist with sampling, transcription, coding, sentiment analysis, synthesis, competitor monitoring and scenario generation. It can also amplify privacy, discrimination, intellectual-property and accuracy risks.

6.1 Main risks

Confidentiality risk arises when interview transcripts or unreleased strategy are entered into a service that stores prompts or uses them for model improvement. Bias risk arises when training data, labels or proxies systematically disadvantage groups. Hallucination and fabrication risk arises when a system generates plausible but unsupported quotations, citations or competitor claims. Inference risk arises when a model predicts sensitive traits that participants did not disclose. Automation bias occurs when researchers accept an apparently confident output without adequate verification.

6.2 Responsible-AI principles

A responsible approach includes:

• a defined and legitimate use case;
• data minimization and de-identification before model input;
• approved tools and vendor assessment;
• human review of important outputs;
• testing for accuracy, subgroup performance and disparate impact;
• traceability of prompts, sources, model versions and decisions;
• disclosure when AI materially affects analysis or participant interaction;
• a route for correction, appeal and human reconsideration;
• prohibition of fabricated evidence or unverified quotations.

AI-generated summaries should be treated as analytical aids, not primary evidence. Each material claim should be traceable to source data. If a model classifies respondents, the research team should examine whether the classification is necessary, explainable and fair enough for the decision at hand.

6.3 Automated recruitment and interaction

Chatbots and algorithmic advertising can create additional consent concerns. Participants should know when they are interacting with an automated system if that fact affects their decision to participate. Recruitment models should be monitored for exclusionary targeting, deceptive personalization and the use of sensitive attributes or proxies.

7. A Governance Framework for Market Research

Governance makes responsibility operational. A proportionate framework can be organized into seven stages.

Stage 1: Define purpose and risk

Record the research question, sponsor, populations affected, methods, data categories, expected benefits and foreseeable harms. Classify risk by sensitivity, identifiability, vulnerability, scale, automation and potential consequence.

Stage 2: Assign roles

Identify a project owner, research lead, data steward, security contact, legal or privacy adviser and decision-maker for ethical escalation. A responsibility matrix should clarify who approves collection, access, analysis, publication, incident response and deletion.

Stage 3: Design collection and consent

Prepare recruitment scripts, consent materials, questionnaires, interview guides and recording notices. Remove unnecessary fields. Pilot the materials with representatives of the target population, including accessibility and language checks.

Stage 4: Approve vendors and data flows

Map where information is collected, transmitted, stored, analyzed and deleted. Assess survey platforms, transcription services, panels, cloud providers and AI tools. Contracts should address confidentiality, security, subprocessors, breach notification, deletion and audit cooperation.

Stage 5: Control access and maintain records

Use least privilege, authentication, access logs and separation of identifiers. Maintain a data inventory, consent records, version-controlled instruments, processing decisions, deviations and approvals. Documentation supports accountability and improves reproducibility.

Stage 6: Monitor and report responsibly

Report methods, sample limitations, missing data, sponsorship, incentives and material uncertainty. Suppress or aggregate small cells where individuals could be identified. Do not overstate causal conclusions from descriptive market research. Separate observed facts, participant perceptions, analyst interpretations and forecasts.

Stage 7: Close, review and improve

Complete deletion or anonymization, revoke access, evaluate incidents and record lessons learned. Review whether the research delivered value proportionate to its burdens. Governance is iterative: new technology, new jurisdictions and new data uses require reassessment.

A useful decision rule is: if the team would be uncomfortable explaining the collection method, data use or AI assistance to participants, a regulator or a well-informed journalist, the project probably requires redesign or stronger justification. This is not a legal test, but it is a valuable accountability prompt.

8. Applied Case: The BrightCart Voice-of-Customer Study

The following is an illustrative case.

Background

BrightCart, an online grocery start-up, plans to interview 2,000 customers about delivery failures and to analyze customer-service calls using an AI transcription and sentiment tool. Management wants to identify high-value customers and predict which users may stop ordering.

Problem

The proposed design collects full names, exact addresses, order histories, voice recordings, health-related food preferences and open-ended complaints. The vendor’s terms permit retention of uploaded audio for service improvement. The research manager proposes telling participants only that calls “may be recorded for quality purposes.” Marketing also wants to share individual risk scores with advertising partners.

Analysis

The project has a legitimate commercial purpose, but it creates several risks. Exact addresses may be unnecessary for the research question. Voice recordings are identifying and may reveal sensitive information. The quality-purpose notice does not adequately explain research use, AI processing or possible sharing. The vendor’s secondary use conflicts with confidentiality expectations. Predictive scores may be inaccurate or discriminatory, particularly if disability, illness or socioeconomic conditions are represented indirectly in complaints. Sharing individual scores with advertisers would be a separate and intrusive use.

Approach and solution

BrightCart redesigns the study as follows:

1. It defines two purposes: service-improvement research and aggregate churn analysis.
2. It collects a regional code rather than an exact address and removes direct identifiers before analysis.
3. It obtains specific, plain-language consent for recording, transcription, AI-assisted coding, retention and publication of anonymized quotations.
4. It offers a non-recorded participation route and explains that refusal will not affect service.
5. It negotiates vendor terms prohibiting model training on BrightCart data, requiring deletion and restricting subprocessors.
6. It separates research data from account and marketing systems.
7. It tests the churn model for subgroup error and uses it only for service outreach, not exclusion, pricing or advertising eligibility.
8. It reports aggregate findings and suppresses small demographic cells.
9. It establishes access controls, an incident procedure and a six-month deletion schedule for raw audio unless a documented need justifies longer retention.

Outcome

The revised project produces actionable service insights while reducing unnecessary collection and unauthorized secondary use. Although the sample is slightly smaller because some customers decline recording, the response quality improves and the organization can explain its methods to participants and business partners.

Learning points

The case demonstrates that ethical governance is not simply a constraint on innovation. Purpose separation, minimization and human oversight can improve analytical validity and reduce strategic risk. It also shows why consent, vendor contracts, AI governance and retention decisions must be designed together rather than added at the end.

9. Challenges and Critical Limitations

Ethical governance involves genuine trade-offs. Complete anonymity may prevent longitudinal analysis. Detailed demographic data may be necessary to detect unequal outcomes, yet collecting such data increases sensitivity. Incentives may improve participation but can influence responses. Public-data research may be valuable while still creating privacy harms through aggregation and inference.

Researchers should therefore avoid both extremes: treating ethics as a checklist and treating any risk as a reason to abandon useful research. Proportionality requires comparing the importance of the purpose with the probability and severity of harm, the availability of less intrusive alternatives and the safeguards that can reduce residual risk.

Another limitation is organizational culture. A formally excellent policy is ineffective if deadlines encourage researchers to bypass approval, managers demand identifiable results, or analysts are rewarded for dramatic claims. Governance must therefore include training, leadership commitment, escalation channels and consequences for misuse.

Finally, compliance frameworks can be fragmented across countries and sectors. A project may involve a sponsor in one country, participants in another, a cloud provider in a third and an AI service operating globally. Legal review is appropriate when data are sensitive, cross-border, large-scale, automated or likely to affect individuals materially.

10. Best-Practice Checklist

Before launching a project, ask:

• Is the purpose specific, legitimate and necessary?
• Have affected people been identified, including non-participants who may be observed?
• Is consent informed, voluntary, accessible and appropriately documented?
• Are sensitive data, recordings and identifiers necessary?
• Can the same objective be achieved with less data or less intrusive methods?
• Are confidentiality and anonymity claims accurate?
• Are intellectual-property permissions and competitor-information boundaries clear?
• Are vendors, cloud locations and AI tools approved?
• Are access, retention, deletion and incident procedures documented?
• Have fairness, subgroup impacts and re-identification risks been assessed?
• Will reporting distinguish evidence from interpretation and uncertainty?
• Can the organization demonstrate accountability after the project ends?

Chapter Summary

Ethical market research respects autonomy, minimizes harm, distributes burdens fairly and reports evidence honestly. Informed consent is an ongoing process requiring understandable information, voluntariness and realistic withdrawal terms. Privacy concerns appropriate control over information; confidentiality concerns restricted disclosure; anonymity concerns the absence of a reasonable link to identity; and pseudonymization reduces direct identification without necessarily eliminating personal-data status.

Data protection requires a defined purpose, lawful and transparent processing, minimization, accuracy, security, controlled retention and respect for applicable individual rights. Intellectual-property and competitor research require attention to copyright, licensing, trade secrets, confidentiality and contractual ownership. AI can improve efficiency but introduces risks involving sensitive inputs, bias, hallucinated evidence, opaque inference and automation bias. Responsible use requires approved tools, minimization, testing, traceability and human accountability.

A governance framework assigns roles, maps data flows, approves methods and vendors, controls access, documents decisions, monitors fairness, reports limitations and closes the project securely. Effective governance is strategic: it protects people, improves evidence quality and preserves organizational trust.

Key Terms

Anonymity: A condition in which information cannot reasonably be linked to an identified or identifiable person.

Artificial intelligence: Computational systems that perform tasks commonly associated with human reasoning, prediction, language or perception.

Confidentiality: The obligation to restrict information access or disclosure according to an agreed arrangement.

Consent: A voluntary and informed indication that a person agrees to participate or permits specified processing.

Data minimization: Collecting and using no more personal information than is necessary for the defined purpose.

Data protection: Legal, technical and organizational measures governing personal-information processing.

Ethical governance: Structures and processes that translate moral principles into accountable decisions and controls.

Fairness: The requirement to avoid unjustified discrimination and distribute research burdens and benefits appropriately.

Informed consent: An ongoing process of information, understanding, voluntary choice and documented agreement.

Intellectual property: Legally protected creations, information, identifiers and related rights.

Legitimate interest: A possible legal basis for processing in some jurisdictions, subject to necessity, balancing and transparency requirements.

Pseudonymization: Replacing direct identifiers with codes while retaining a possible means of re-linking records.

Privacy: Appropriate control over access to a person, their activities and information about them.

Purpose limitation: Using collected information only for specified, legitimate and compatible purposes.

Research governance: Roles, approvals, controls, records and oversight used to direct and account for research.

Sensitive data: Information requiring heightened protection because disclosure or misuse could cause significant harm or discrimination.

Storage limitation: Retaining information no longer than necessary for the relevant purpose or obligation.

Trade secret: Confidential business information that derives value from not being generally known and is protected through reasonable measures.

Transparency: Clear communication about methods, purposes, data uses, risks, sponsorship and limitations.

Review Questions

5 Short Answer Questions

1. Distinguish privacy, confidentiality, anonymity and pseudonymization.
2. Why is a signed consent form not by itself sufficient to establish informed consent?
3. State three principles of data protection relevant to market research.
4. Why should researchers be cautious when using competitor information supplied by a former employee?
5. Identify two risks associated with entering interview transcripts into an AI service.

5 Long Answer Questions

1. Explain how respect for persons, beneficence, justice and research integrity apply to a customer survey.
2. Design an informed-consent process for a recorded study involving employees as participants.
3. Discuss how data minimization, security and retention controls should be integrated across a research project.
4. Compare legitimate competitive intelligence with unethical or unlawful acquisition of confidential competitor information.
5. Evaluate the governance requirements for using AI to classify customer sentiment and predict churn.

3 Analytical / Application Questions

1. A university entrepreneurship team plans to scrape public reviews, infer users’ health conditions and sell individual-level segments to advertisers. Analyze the ethical, privacy and governance problems and propose a redesigned study.
2. A research vendor stores recordings in another country and uses them to improve its transcription model. Develop a due-diligence and risk-mitigation plan before the vendor is approved.
3. A start-up’s predictive model performs well overall but produces substantially more false positives for one demographic group. Explain how the team should investigate, report and govern the model before using it in customer decisions.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes confidentiality from anonymity?

A. Confidentiality concerns restricted disclosure, while anonymity concerns the absence of a reasonable link to identity.

B. Confidentiality applies only to health data, while anonymity applies to financial data.

C. Confidentiality means data are deleted immediately, while anonymity means data are encrypted.

D. Confidentiality is a legal concept, while anonymity is never relevant to research.

Correct Answer: A. Confidentiality concerns restricted disclosure, while anonymity concerns the absence of a reasonable link to identity.

Question 2

Which practice most directly demonstrates data minimization?

A. Collecting exact birth dates for every respondent in every study

B. Collecting regional codes when precise addresses are unnecessary

C. Retaining all raw data permanently for possible future use

D. Combining research responses with marketing profiles by default

Correct Answer: B. Collecting regional codes when precise addresses are unnecessary

Question 3

What is the primary purpose of informed consent?

A. To guarantee that a study will produce commercially useful results

B. To transfer ownership of a participant’s personal information to the researcher

C. To support an informed and voluntary decision about participation and specified data use

D. To eliminate all legal responsibilities of the sponsoring organization

Correct Answer: C. To support an informed and voluntary decision about participation and specified data use

Question 4

Which statement about pseudonymized data is most accurate?

A. They are always anonymous and outside data-protection rules.

B. They can never be connected to a participant under any circumstances.

C. They replace direct identifiers but may remain linkable through a key or other information.

D. They cannot be used for longitudinal research.

Correct Answer: C. They replace direct identifiers but may remain linkable through a key or other information.

Question 5

A competitor’s unpublished product roadmap is offered by a former employee. What is the most responsible initial response?

A. Accept it because the employee voluntarily offered it.

B. Publish it with attribution to demonstrate research credibility.

C. Clarify that confidential information is not requested and seek legal or ethical guidance on handling it.

D. Upload it to an AI tool for independent verification.

Correct Answer: C. Clarify that confidential information is not requested and seek legal or ethical guidance on handling it.

Question 6

Which is an example of automation bias in market research?

A. A researcher checks model outputs against original interview evidence.

B. A researcher assumes a confident AI-generated claim is correct without verification.

C. A company limits an AI tool to de-identified data.

D. A team documents the model version used for analysis.

Correct Answer: B. A researcher assumes a confident AI-generated claim is correct without verification.

Question 7

Which governance control most directly supports least privilege?

A. Giving every project member access to the full identifiable dataset

B. Allowing access only to the information and functions required for a person’s role

C. Removing all access logs to protect employee privacy

D. Storing all files in a shared personal email account

Correct Answer: B. Allowing access only to the information and functions required for a person’s role

Question 8

Why should researchers disclose realistic limits on withdrawal?

A. Because anonymized aggregate results may no longer be practically removable from the analysis

B. Because participants are never allowed to withdraw from research

C. Because withdrawal is relevant only when compensation is provided

D. Because withdrawal automatically invalidates every response in the study

Correct Answer: A. Because anonymized aggregate results may no longer be practically removable from the analysis

Question 9

Which practice best supports responsible AI use in research?

A. Using raw confidential transcripts in any free online model

B. Allowing AI to generate quotations that were not present in the data

C. Maintaining source traceability and human review for material findings

D. Using sensitive attributes to maximize advertising personalization

Correct Answer: C. Maintaining source traceability and human review for material findings

Question 10

What is the central function of a retention schedule?

A. To ensure that all research data are kept permanently

B. To specify what is retained, for how long, by whom and how it will be deleted or anonymized

C. To replace the need for access controls

D. To permit vendors to retain data for unspecified future purposes

Correct Answer: B. To specify what is retained, for how long, by whom and how it will be deleted or anonymized